Eclipse NetX Duo Out-of-Bounds Read Vulnerability in IP Packet Reception

A potential out-of-bounds read vulnerability has been identified in Eclipse NetX Duo versions through 6.4.3. The issue arises in the '_nx_ip_packet_receive()' function within the networking support module for Eclipse Foundation ThreadX. The vulnerability occurs when an Ethernet frame is received with the type set to IP but without any accompanying IP data. This lack of data allows for an out-of-bounds read, as the function does not properly validate the IP header before processing it. In theory, such an out-of-bounds read could lead to a crash or an information leak.

Impact

Exploitation of this vulnerability could cause a crash or an information leak.

Remediation

Users can upgrade to Eclipse NetX Duo version 6.4.4 or later to address this vulnerability.