CVE-2025-55079
📋 TL;DR
This vulnerability in Eclipse ThreadX allows threads to be created with higher priority than configured maximum, potentially causing denial of service through resource starvation. It affects all systems using vulnerable versions of Eclipse ThreadX, particularly embedded and IoT devices.
💻 Affected Systems
- Eclipse ThreadX
📦 What is this software?
Threadx by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Critical system threads could be starved of CPU resources, causing complete system lockup or failure of essential functions in embedded systems.
Likely Case
Degraded system performance, intermittent service disruptions, or instability in multi-threaded applications.
If Mitigated
Minimal impact with proper thread priority management and monitoring in place.
🎯 Exploit Status
Requires ability to create threads with manipulated priority values. Likely requires local code execution or compromised application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.3
Vendor Advisory: https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-w8rw-fqgj-9r49
Restart Required: No
Instructions:
1. Update Eclipse ThreadX to version 6.4.3 or later. 2. Recompile any applications using ThreadX with the updated library. 3. Deploy updated firmware/software to affected devices.
🔧 Temporary Workarounds
Thread Priority Monitoring
allImplement runtime monitoring of thread priorities to detect and log any threads exceeding configured maximum priority.
🧯 If You Can't Patch
- Implement strict thread creation policies and review all thread priority assignments in application code.
- Add runtime assertions to validate thread priority values before thread creation in custom wrapper functions.
🔍 How to Verify
Check if Vulnerable:
Check ThreadX version in your firmware/software. If version is below 6.4.3, you are vulnerable.Check Version:
Check build configuration or firmware version information for ThreadX version string.Verify Fix Applied:
Verify ThreadX version is 6.4.3 or higher and test thread creation with various priority values to ensure proper validation.📡 Detection & Monitoring
Log Indicators:
- Unexpected thread priority values in system logs
- Thread creation failures or warnings related to priority
Network Indicators:
- None - this is a local threading issue
SIEM Query:
Search for thread creation events with priority values exceeding system maximum configuration.