CVE-2024-2212 is a critical vulnerability affecting Eclipse ThreadX versions prior to 6.4.0, specifically within the xQueueCreate() and xQueueCreateSet() functions of the FreeRTOS compatibility API. The absence of proper parameter checks can lead to integer wraparound, under-allocations, and subsequent heap buffer overflows. With a CVSS score of 7.8 (HIGH), this vulnerability has a local attack vector and low attack complexity, requiring user interaction (UI:R) but no privileges (PR:N). Successful exploitation could result in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are limited, with only one mention and one article identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.4.0CPE matchmatch criteria | cpe:2.3:a:eclipse:threadx:*:*:*:*:*:*:*:* | ||
>= 0, < 6.4.0CPE match | cpe:2.3:a:eclipse:threadx:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.