Privilege Escalation in Eclipse ThreadX Cortex-M

Executive Summary

This vulnerability affects Eclipse ThreadX versions 6.0.1 through 6.5.2.202603. The PendSV handler in the Cortex-M module saves a preempted user-mode thread's registers in privileged mode using addresses from the thread's stack pointer without validating the pointer against the thread's stack. This allows a user-mode module to write up to nine words (or 25 with floating-point state) into memory below any writable region, potentially corrupting adjacent memory.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your Eclipse ThreadX version is within the affected range (6.0.1 to 6.5.2.202603). Use commands like 'tx_version' or inspect build files for version details. If using Cortex-M ports with Module Manager, verify if the stack pointer validation fix is applied in versions after 6.5.2.202603b.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to corrupt memory, crash the system, or escalate privileges by writing malicious data into adjacent memory regions. This could lead to denial of service, data corruption, or unauthorized code execution in privileged contexts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized memory access or data leakage, which may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information). Unauthorized memory writes could expose sensitive data, leading to compliance breaches if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Eclipse ThreadX to a version beyond 6.5.2.202603 to address the stack pointer validation issue in the PendSV handler.

Useful 0 Not Useful 0