Description
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo | 6.4.0 – ≤ 6.5.2.202603a | 6.5.2.202603b |