جزئیات آسیب‌پذیری

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/482