Eclipse Threadx Levelx Nand Driver
Monthly
An out-of-bounds heap write in Eclipse ThreadX LevelX's NAND flash-translation-layer metadata parser can give a local attacker control-flow hijack when the device mounts a crafted NAND flash image through lx_nand_flash_open(), overwriting a driver function pointer with an attacker-chosen 8-byte value; two accompanying out-of-bounds reads were also demonstrated. The bug (CWE-787) is rated 8.6 under CVSS 4.0 and independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication or user interaction is needed but the attacker must first supply or tamper with the flash image (removable or attached NAND media, modified firmware or OTA image, or supply-chain/provisioning substitution). No public exploit code was identified at time of analysis, though the issue was reproduced verbatim under ASan at HEAD 9f1cfdc; devices that only mount internally trusted flash images are not realistically reachable, while those accepting field-swappable or externally sourced NAND are directly exposed, with the worst impact on bare-metal or non-memory-protected targets where the hijacked pointer yields code execution.
An out-of-bounds heap write in Eclipse ThreadX LevelX's NAND flash-translation-layer metadata parser can give a local attacker control-flow hijack when the device mounts a crafted NAND flash image through lx_nand_flash_open(), overwriting a driver function pointer with an attacker-chosen 8-byte value; two accompanying out-of-bounds reads were also demonstrated. The bug (CWE-787) is rated 8.6 under CVSS 4.0 and independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication or user interaction is needed but the attacker must first supply or tamper with the flash image (removable or attached NAND media, modified firmware or OTA image, or supply-chain/provisioning substitution). No public exploit code was identified at time of analysis, though the issue was reproduced verbatim under ASan at HEAD 9f1cfdc; devices that only mount internally trusted flash images are not realistically reachable, while those accepting field-swappable or externally sourced NAND are directly exposed, with the worst impact on bare-metal or non-memory-protected targets where the hijacked pointer yields code execution.