GHSA-76hh-wrj5-hr2v: Improper Parameter Check in ThreadX Syscall Implementation
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55080 |
Severity |
High |
CWE |
|
Published |
2025‑10‑15 |
Last updated |
2025‑10‑15 |
Description
Vulnerability Summary
An improper parameter check vulnerability has been identified in the ThreadX syscall implementation when memory protection is enabled. This vulnerability allows an attacker to bypass user-kernel isolation, leading to privilege escalation and arbitrary memory read/write.
Vulnerability Location: These vulnerable macros are located in the file:
threadx/common_modules/module_manager/inc/txm_module_manager_util.h
/* Kernel objects should be outside the module at the very least. */
#define TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_USE(module_instance, obj_ptr, obj_size) \
(TXM_MODULE_MANAGER_ENSURE_OUTSIDE_MODULE(module_instance, obj_ptr, obj_size) || \
(_txm_module_manager_created_object_check(module_instance, (void *)obj_ptr) == TX_FALSE) || \
((void *) (obj_ptr) == TX_NULL))
/* When creating an object, the object must be inside the object pool. */
#define TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_CREATION(module_instance, obj_ptr, obj_size) \
((TXM_MODULE_MANAGER_ENSURE_INSIDE_OBJ_POOL(module_instance, obj_ptr, obj_size) && \
(_txm_module_manager_object_size_check(obj_ptr, obj_size) == TX_SUCCESS)) || \
(_txm_module_manager_created_object_check(module_instance, (void *)obj_ptr) == TX_FALSE) || \
((void *) (obj_ptr) == TX_NULL))
Vulnerability Description
The vulnerability arises from the incorrect use of parameter checking functions. Specifically, ThreadX uses two macros—TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_USE and TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_CREATION—to verify whether a kernel object pointer is pointing to a valid kernel object.
In TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_USE, the macro relies on TXM_MODULE_MANAGER_ENSURE_OUTSIDE_MODULE and _txm_module_manager_created_object_check to check whether the obj_ptr is outside the module and points to a valid created kernel object. However, the following conditional statement is used to validate whether obj_ptr is legal:
(TXM_MODULE_MANAGER_ENSURE_OUTSIDE_MODULE(module_instance, obj_ptr, obj_size) || \
(_txm_module_manager_created_object_check(module_instance, (void *)obj_ptr) == TX_FALSE) || \
((void *) (obj_ptr) == TX_NULL))
This conditional check can incorrectly return true when _txm_module_manager_created_object_check returns a false value, allowing an attacker to bypass the check. A similar issue exists in TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_USE.
Impact
This vulnerability is related to [CWE-233](https://cwe.mitre.org/data/definitions/233.html), it allows an attacker to achieve privilege escalation and arbitrary memory read/write.
Recommended Modification
/* Kernel objects should be outside the module at the very least. */
#define TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_USE(module_instance, obj_ptr, obj_size) \
((TXM_MODULE_MANAGER_ENSURE_OUTSIDE_MODULE(module_instance, obj_ptr, obj_size) && \
(_txm_module_manager_created_object_check(module_instance, (void *)obj_ptr) == TX_TRUE)) || \
(void *) (obj_ptr) == TX_NULL)
/* When creating an object, the object must be inside the object pool. */
#define TXM_MODULE_MANAGER_PARAM_CHECK_OBJECT_FOR_CREATION(module_instance, obj_ptr, obj_size) \
((TXM_MODULE_MANAGER_ENSURE_INSIDE_OBJ_POOL(module_instance, obj_ptr, obj_size) && \
(_txm_module_manager_object_size_check(obj_ptr, obj_size) == TX_SUCCESS) && \
(_txm_module_manager_created_object_check(module_instance, (void *)obj_ptr) == TX_TRUE)) || \
((void *) (obj_ptr) == TX_NULL))