What is CVE-2024-2214?

CVE-2024-2214 is a high-severity vulnerability in Eclipse Threadx, classified under Improper Validation of Array Index. CVSS score: 7.0/10. Published 2024-03-26.

How severe is CVE-2024-2214?

High severity. CVSS v3 base score is 7.0 out of 10.

Is CVE-2024-2214 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Eclipse Threadx

CVE-2024-2214

In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was ports/xtensa/xcc/src/tx_clib_lock.c

EPSS: 0.003 (25.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Eclipse Threadx
Eclipse Foundation Threadx — versions 0

Weakness classification (CWE)

CWE-129 — Improper Validation of Array Index

Public proof-of-concept exploits

References

emo@eclipse.org (Patch, Vendor Advisory)
emo@eclipse.org (Mailing List)
emo@eclipse.org (Mailing List)

Frequently asked questions

What is CVE-2024-2214?: CVE-2024-2214 is a high-severity vulnerability in Eclipse Threadx, classified under Improper Validation of Array Index. CVSS score: 7.0/10. Published 2024-03-26.
How severe is CVE-2024-2214?: High severity. CVSS v3 base score is 7.0 out of 10.
Is CVE-2024-2214 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.