جزئیات آسیب‌پذیری

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500