[threadx-dev] Three CVEs for ThreadX published

[Marta Rybczynska <marta.rybczynska@xxxxxxxxxxxxxxxxxxxxxx>]

Dear all,

We have just published three CVEs for ThreadX (various modules)

CVE-2024-2212  HIGH Integer wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreate Set()

CVE-2024-2214  HIGH Missing array size check in _Mtxinit() in the Xtensa port

CVE-2024-2452  HIGH Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc()

All have been fixed in the 6.4.0 release.

Please note that the EF Security Team typically does not send such messages as the Project team decides on how to communicate, but those issues come from the backlog and the project is in the migration phase. So, I do send it out so that everyone is aware.

Kind regards,

Marta Rybczynska

Technical Program Manager, Security Team, Eclipse Foundation