GHSA-cf2g-j6vv-m8c5: Potential out of bound read issue in _nx_ipv4_packet_receive()
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55090 |
Severity |
Medium |
CWE |
|
Published |
2025‑10‑16 |
Last updated |
2025‑10‑16 |
Description
The _nx_ipv4_packet_receive() function is called to parse an IPv4 packet. It reads the header and then passes the data up to a higher level protocol (e.g., TCP, UDP, …). At the start of the function, it reads out the first 4 bytes from the IPv4 packet. There is no bounds check to make sure those bytes are in scope. If a malicious attacker sends an ethernet frame with less than 4 bytes of IP data, then it could read out of bound (or interpret non IP data as IP data). In theory, an out of bound read could lead to a crash or possibly to an information leak.
code:
threadx\netxduo-master\common\src\nx_ipv4_packet_receive.c
VOID _nx_ipv4_packet_receive(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
{
...
ip_header_ptr = (NX_IPV4_HEADER *)packet_ptr -> nx_packet_prepend_ptr;
...
val = ip_header_ptr -> nx_ip_header_word_0; // <-- This could read out of bounds
...
}