Microsoft researchers on Thursday disclosed two dozen vulnerabilities affecting a wide range of Internet of Things (IoT) and Operational Technology (OT) devices used in industrial, medical, and enterprise networks that could be abused by adversaries to execute arbitrary code and even cause critical systems to crash.
“These remote code execution (RCE) vulnerabilities cover more than 25 CVEs and potentially affect a wide range of domains, from consumer and medical IoT to Industrial IoT, Operational Technology, and industrial control systems,” said Microsoft’s ‘Section 52’ Azure Defender for IoT research group.
The flaws have been collectively named “BadAlloc,” for they are rooted in standard memory allocation functions spanning widely used real-time operating systems (RTOS), embedded software development kits (SDKs), and C standard library (libc) implementations. A lack of proper input validations associated with these memory allocation functions could enable an adversary to perform a heap overflow, leading to the execution of malicious code on a vulnerable device.
“Successful exploitation of these vulnerabilities could result in unexpected behavior such as a crash or a remote…
http://feedproxy.google.com/~r/TheHackersNews/~3/D2K998NRIkY/microsoft-finds-badalloc-flaws.html
