CVE-2024-2212: Integer wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreateSet()
In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtoscompatibilitylayers/FreeRTOS/txfreertos.c) were missing parameter checks. This could lead to integer wraparound, under-allocations and heap buffer overflows.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2212?
CVE-2024-2212 is considered to have a high severity due to its potential for integer wraparound and subsequent heap buffer overflows.
How do I fix CVE-2024-2212?
To fix CVE-2024-2212, upgrade Eclipse ThreadX to version 6.4.0 or later where the parameter checks in xQueueCreate() and xQueueCreateSet() have been implemented.
What software is affected by CVE-2024-2212?
CVE-2024-2212 affects Eclipse ThreadX versions prior to 6.4.0.
What are the risks associated with CVE-2024-2212?
The risks associated with CVE-2024-2212 include potential memory corruption and application crashes due to heap buffer issues.
When was CVE-2024-2212 disclosed?
CVE-2024-2212 was disclosed in May 2024.