Eclipse NetX Duo Out-of-Bounds Read Vulnerability in ICMPv6 Option Validation

A moderate out-of-bounds read vulnerability has been identified in Eclipse NetX Duo versions through 6.4.3. The issue arises in the networking support module for Eclipse Foundation ThreadX, specifically within the `_nx_icmpv6_validate_options()` function. This function, responsible for parsing and validating ICMPv6 options in received packets, can be exploited by malformed ICMPv6 packets that contain incomplete option structures. Such packets may cause the function to read memory outside the intended bounds, leading to potential information disclosure or memory corruption.

Impact

Exploitation of this vulnerability could result in an out-of-bounds read, allowing for the possibility of reading memory outside the intended buffer boundaries. This type of memory access can often be exploited to disclose sensitive information or manipulate program execution.

Remediation

Users can upgrade to Eclipse NetX Duo version 6.4.4 or later to address this vulnerability.