Heap Overflow in FX_MEDIA Driver via Faulty FAT Image

Executive Summary

This vulnerability involves mounting a malicious FAT image with fault tolerance enabled in FileX (Eclipse ThreadX). During log replay, an out-of-bounds heap write occurs because the destination offset and copy size are read from the disk log without proper bounds checking. This allows writing past the intended buffer, potentially overwriting the FX_MEDIA driver callback and enabling code execution.

Useful 0 Not Useful 0

Detection Guidance

Check FileX version with fx_system_verion_get() or inspect build logs for versions up to 6.5.1.202602. Monitor for crashes during FAT image mounting with fault tolerance enabled. Look for heap corruption errors in logs when FX_ENABLE_FAULT_TOLERANT is active.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code on the affected system by providing a specially crafted FAT image. This could lead to system compromise, data theft, or denial of service. The attack requires enabling fault tolerance and calling fx_fault_tolerant_enable(), but no memory layout dependency exists.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables arbitrary code execution through crafted FAT images, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, this may violate principles of data integrity and confidentiality. For HIPAA, it could compromise protected health information integrity. Compliance may be affected if systems handling sensitive data are impacted.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FileX to version 6.5.2.202603 or later. Disable fault tolerance via FX_ENABLE_FAULT_TOLERANT configuration if not required. Avoid mounting untrusted FAT images when fault tolerance is enabled.

Useful 0 Not Useful 0