Eclipse NetX Duo ThreadX Out-of-Bounds Read Vulnerability in TLS Client Hello Processing

A moderate out-of-bounds read vulnerability has been identified in Eclipse NetX Duo versions prior to 6.4.4. The issue arises in the ThreadX component, specifically within the `_nx_secure_tls_process_clienthello()` function. The vulnerability is caused by a lack of proper validation for the length of the Pre-Shared Key (PSK) identity provided in the TLS client hello message. This oversight could lead to an out-of-bounds read, allowing potential information leakage, especially if cryptographic keys are stored in contiguous memory.

Impact

Exploitation of this vulnerability could result in an out-of-bounds read, causing an information leak. This could allow an attacker to recover cryptographic keys if they are stored in contiguous memory.

Remediation

Users can upgrade to NetX Duo version 6.4.4 or later to address this vulnerability.