Eclipse NetX Duo Out-of-Bounds Read Vulnerability in IPv4 Packet Reception

A moderate out-of-bounds read vulnerability has been identified in Eclipse NetX Duo versions through 6.4.3. The issue arises in the '_nx_ipv4_packet_receive()' function, which processes IPv4 packets by reading the first four bytes of the IP header. The vulnerability occurs because there is no bounds checking to ensure that the Ethernet frame contains a sufficient amount of data. An attacker could exploit this by sending a frame with fewer than four bytes of IP data, potentially leading to a crash or an information leak.

Impact

Exploitation of this vulnerability could result in an out-of-bounds read, which may cause a crash or an information leak.

Remediation

Users can upgrade to NetX Duo version 6.4.4 or later to address this vulnerability.