Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Eclipse |
|
No data.
No data.
References
History
Wed, 04 Nov 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.) | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. |
| Title | Unbounded Out-of-Bounds Write in Eclipse ThreadX LevelX NAND Driver Enables Control-Flow Hijack | Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX |
Wed, 30 Sep 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Eclipse
Eclipse threadx/levelx(nand Driver) |
|
| Vendors & Products |
Eclipse
Eclipse threadx/levelx(nand Driver) |
Tue, 29 Sep 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unbounded Out-of-Bounds Write in Eclipse ThreadX LevelX NAND Driver Enables Control-Flow Hijack |
Tue, 29 Sep 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 29 Sep 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.) | |
| Weaknesses | CWE-1284 CWE-787 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: eclipse
Published: 2026-09-29T17:59:30.553Z
Updated: 2026-11-10T14:53:43.542Z
Reserved: 2026-09-29T16:15:23.917Z
Link: CVE-2026-102730
Vulnrichment
Updated: 2026-09-29T18:24:42.538Z
NVD
Status : Awaiting Analysis
Published: 2026-09-29T18:17:12.770
Modified: 2026-11-10T15:17:11.010
Link: CVE-2026-102730
Redhat
No data.