Integer Wraparound and Heap Buffer Overflows in Eclipse ThreadX Before 6.4.0
CVE-2024-2212
7.8HIGH
What is CVE-2024-2212?
Eclipse ThreadX before version 6.4.0 contains vulnerabilities related to memory management within the FreeRTOS compatibility API. The functions xQueueCreate() and xQueueCreateSet() lack adequate parameter validation, resulting in potential integer wraparound scenarios, under-allocations, and heap buffer overflows. Exploitation of these vulnerabilities can compromise application stability and security, allowing for unauthorized access and manipulation of sensitive data. It is crucial for developers using affected versions to implement necessary patches to mitigate these risks.
Affected Version(s)
ThreadX 0 < 6.4.0
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Marco Ivaldi