Eclipse Threadx Threadx Module Manager Loadable Module Loader
Monthly
Out-of-bounds heap read and a control-flow-integrity gap in the Eclipse ThreadX loadable-module loader (module manager) allow an attacker-supplied module image to trigger out-of-bounds memory disclosure when the device loads it through `_txm_module_manager_memory_load` or `_txm_module_manager_in_place_load`. The affected code fully trusts every size and offset field in `TXM_MODULE_PREAMBLE` - the loader APIs accept only a base pointer and no image length, and the preamble `checksum` is never verified - so `code_size` can drive the code-copy loop past the end of the source image; the copy destination is overflow-guarded, so no controlled out-of-bounds write was found. Exploitation is local and conditional: no authentication or privileges are required (PR:N), but attack complexity is high, user/operator action is needed to trigger the load, and only systems that actually load third-party or externally supplied modules are exposed; no public exploit was identified at time of analysis.
Out-of-bounds heap read and a control-flow-integrity gap in the Eclipse ThreadX loadable-module loader (module manager) allow an attacker-supplied module image to trigger out-of-bounds memory disclosure when the device loads it through `_txm_module_manager_memory_load` or `_txm_module_manager_in_place_load`. The affected code fully trusts every size and offset field in `TXM_MODULE_PREAMBLE` - the loader APIs accept only a base pointer and no image length, and the preamble `checksum` is never verified - so `code_size` can drive the code-copy loop past the end of the source image; the copy destination is overflow-guarded, so no controlled out-of-bounds write was found. Exploitation is local and conditional: no authentication or privileges are required (PR:N), but attack complexity is high, user/operator action is needed to trigger the load, and only systems that actually load third-party or externally supplied modules are exposed; no public exploit was identified at time of analysis.