GHSA-vwh7-h99r-fvwq: Potential out of bound read in _nx_ipv4_option_process()
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55092 |
Severity |
Medium |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
The _nx_ipv4_option_process() function is called to process IPv4 options. It loops over the options, making sure it can read at least 1 byte in each iterations (type). When processing NX_IP_OPTION_INTERNET_TIMESTAMP options, it reads 3 more bytes. However, there is no bounds check to make sure those 3 bytes are within bounds, hence the option processing could read out of bounds by 3 bytes.
code:
threadx\netxduo-master\common\src\nx_ipv4_option_process.c
UINT _nx_ipv4_option_process(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
{
NX_IPV4_HEADER *ip_header_ptr;
UCHAR *option_ptr;
ULONG ip_option_length;
...
UINT index = 0;
...
ip_header_ptr = (NX_IPV4_HEADER *)(packet_ptr -> nx_packet_prepend_ptr);
option_ptr = packet_ptr -> nx_packet_prepend_ptr + sizeof(NX_IPV4_HEADER);
...
ip_option_length = ((((ip_header_ptr -> nx_ip_header_word_0 & NX_IP_LENGTH_MASK) >> 24) - NX_IP_NORMAL_LENGTH) & 0xFF) * (ULONG)sizeof(ULONG);
...
while (index < ip_option_length)
{
/* Get the option type. */
op_type = *option_ptr; //
/* Process the option type. */
switch (op_type)
{
...
case NX_IP_OPTION_NO_OPERATION: // <-- fill options with NOP till 1 byte from the end of the buffer.
{
...
option_ptr++;
index++;
continue;
}
case NX_IP_OPTION_INTERNET_TIMESTAMP:
{
...
op_length = *(option_ptr + 1); // <-- this could read out of bounds, there should a length check prior to performing this read.
...
op_timestamp_offset = *(option_ptr + 2); // <-- this could read out of bounds
...
op_timestamp_overflow = (*(option_ptr + 3)) >> 4; // <-- this could read out of bounds
op_timestamp_flags = (*(option_ptr + 3)) & 0xF; // <-- this could read out of bounds
...
break;
}
default:
break;
}
...
}
...
}