Eclipse Threadx Threadx
Monthly
User-mode-to-kernel privilege escalation in Eclipse ThreadX lets a loaded, memory-protected TXM module register an arbitrary function pointer as the global trace-full callback, which privileged kernel code then invokes directly with no pointer validation and no privilege-dropping trampoline when the trace buffer wraps. Affected builds are those compiled with the non-default TX_ENABLE_EVENT_TRACE option and running modules in TXM_MODULE_USER_MODE with TXM_MODULE_MEMORY_PROTECTION; an invalid pointer crashes the kernel (denial of service), while a pointer into the module's own code has been observed executing with kernel privilege (CONTROL.nPRIV = 0), producing a scope-crossing compromise of the RTOS kernel by a local, low-privileged attacker. Exploitation requires the attacker to already control executing code inside a loaded module plus the non-default trace build flag, and no public exploit code has been identified at time of analysis.
User-mode-to-kernel privilege escalation in Eclipse ThreadX lets a loaded, memory-protected TXM module register an arbitrary function pointer as the global trace-full callback, which privileged kernel code then invokes directly with no pointer validation and no privilege-dropping trampoline when the trace buffer wraps. Affected builds are those compiled with the non-default TX_ENABLE_EVENT_TRACE option and running modules in TXM_MODULE_USER_MODE with TXM_MODULE_MEMORY_PROTECTION; an invalid pointer crashes the kernel (denial of service), while a pointer into the module's own code has been observed executing with kernel privilege (CONTROL.nPRIV = 0), producing a scope-crossing compromise of the RTOS kernel by a local, low-privileged attacker. Exploitation requires the attacker to already control executing code inside a loaded module plus the non-default trace build flag, and no public exploit code has been identified at time of analysis.