Integer Wraparound and Heap Buffer Overflows in Eclipse ThreadX Before 6.4.0

CVE-2024-2212

What is CVE-2024-2212?

Eclipse ThreadX before version 6.4.0 contains vulnerabilities related to memory management within the FreeRTOS compatibility API. The functions xQueueCreate() and xQueueCreateSet() lack adequate parameter validation, resulting in potential integer wraparound scenarios, under-allocations, and heap buffer overflows. Exploitation of these vulnerabilities can compromise application stability and security, allowing for unauthorized access and manipulation of sensitive data. It is crucial for developers using affected versions to implement necessary patches to mitigate these risks.

References