Lucene search

K
cvelistEclipseCVELIST:CVE-2024-2452
HistoryMar 26, 2024 - 3:43 p.m.

CVE-2024-2452 Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc()

2024-03-2615:43:36
CWE-190
CWE-120
eclipse
www.cve.org
2
cve-2024-2452
eclipse threadx netx duo
integer wraparound
under-allocation
heap buffer overflow

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

0.0004 Low

EPSS

Percentile

15.7%

In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control
parameters of __portable_aligned_alloc() could cause an integer
wrap-around and an allocation smaller than expected. This could cause
subsequent heap buffer overflows.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "NetX Duo",
    "product": "ThreadX",
    "repo": "https://github.com/eclipse-threadx/netxduo/",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "6.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

0.0004 Low

EPSS

Percentile

15.7%

Related for CVELIST:CVE-2024-2452