GHSA-f3rx-xrwm-q2rf: Eclipse ThreadX NetX Duo IPv6 denial of service

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Neighbour Discovery (ND) Cache is full, and all entries are in CREATED state.

In the driver implementation, the driver introduced new state CREATED and the state defined by the RFC are INCOMPLETE, REACHABLE, STALE, DELAY, PROBE.

As per the RFC, when the ND entry is added the state will be INCOMPLETE and device should immediately send the discovery packet to detect the device reachability. If device not found in the network the ND entry should be in stale state so new device can use this entry. But in the current implementation, once the Neighbour Device entry added in the ND Cache it will wait for the device to send next packet before sending the Neighbour Discovery to find the device availability in the network. Due to this ND Entry will remain in the CREATED state until device want to send new packet.

Since defensics test scenario is keep sending the different IP spoofed “packet too big” packets and device will not send response to this packet, so all the ND Cache is filled with CREATED state. And further it is not getting invalidated or cleared forever. Due to this all-further communication on the new IPv6 Address is blocked until power cycle.

Reference: RFC 4861