GHSA-8pgj-qvjv-j4fq: ThreadX Modules invokes trace-full callbacks after module unload
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Eclipse ThreadX Modules versions 6.0.1 through 6.5.2.202603 are affected when event tracing is enabled and a kernel-owned trace buffer remains active after a module is stopped and unloaded.
What must occur for exploitation to be possible?
A module must have a trace-buffer-full callback registered, then be stopped and unloaded without that callback being revoked. A subsequent trace-buffer wrap can invoke the stale callback from privileged thread context.
What can happen if the stale callback is invoked?
The unloaded module's code may run with kernel privileges. If its released memory has been reused, the condition can redirect control flow or cause a fault.