CVE-2022-39343

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.

• CWE-120
• CWE-190
• CWE-191

• https://github.com/azure-rtos/filex/blob/master/common/src/fx_fault_tolerant_apply_logs.c#L218Patch, Third Party Advisory
• https://github.com/azure-rtos/filex/security/advisories/GHSA-8jqf-wjhq-4w9fExploit, Mitigation, Third Party Advisory
• https://github.com/azure-rtos/filex/blob/master/common/src/fx_fault_tolerant_apply_logs.c#L218Patch, Third Party Advisory
• https://github.com/azure-rtos/filex/security/advisories/GHSA-8jqf-wjhq-4w9fExploit, Mitigation, Third Party Advisory

Published

Nov 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39338user_oidc is an OpenID Connect user backend for Nextcloud. V…5.4
• CVE-2022-39339user_oidc is an OpenID Connect user backend for Nextcloud. I…4.3
• CVE-2022-3934The FlatPM WordPress plugin before 3.0.13 does not sanitise …5.4
• CVE-2022-39340OpenFGA is an authorization/permission engine. Prior to vers…5.3
• CVE-2022-39341OpenFGA is an authorization/permission engine. Versions prio…9.8
• CVE-2022-39342OpenFGA is an authorization/permission engine. Versions prio…9.8
• CVE-2022-39344Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-39345Gin-vue-admin is a backstage management system based on vue …7.5
• CVE-2022-39346Nextcloud server is an open source personal cloud server. Af…6.5
• CVE-2022-39347FreeRDP is a free remote desktop protocol library and client…5.7
• CVE-2022-39348Twisted is an event-based framework for internet application…5.4
• CVE-2022-39349The Tasks.org Android app is an open-source app for to-do li…5.5