GHSA-q2rc-f35r-2hw6: User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
Event History
Frequently Asked Questions
Which versions are affected?
Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are affected.
What does an attacker need to exploit this issue?
An attacker needs code execution in a user-mode, memory-protected module and the ability to post a forged callback request to another module's callback request queue. The attack does not require user interaction.
When does this become a privilege-escalation issue?
Privilege escalation occurs when the receiving module executes in privileged mode. Its callback thread can invoke the forged function pointer, causing attacker-controlled code to run with that module's privilege.