Skip to content

Latest commit

 

History

History
1911 lines (1230 loc) · 54.9 KB

vulnerabilities.rst

File metadata and controls

1911 lines (1230 loc) · 54.9 KB

Vulnerabilities

This page collects all of the vulnerabilities that are discovered and fixed in each release. It will also often have more details than is available in the releases. Some vulnerabilities are deemed to be sensitive, and will not be publicly discussed until there is sufficient time to fix them. Because the release notes are locked to a version, the information here can be updated after the embargo is lifted.

CVE-2017

:cve:`2017-14199`

Buffer overflow in getaddrinfo().

:cve:`2017-14201`

The shell DNS command can cause unpredictable results due to misuse of stack variables.

Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution.

This has been fixed in release v1.14.0.

:cve:`2017-14202`

The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution.

This has been fixed in release v1.14.0.

CVE-2019

:cve:`2019-9506`

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

CVE-2020

:cve:`2020-10019`

Buffer Overflow vulnerability in USB DFU of zephyr allows a USB connected host to cause possible remote code execution.

This has been fixed in releases v1.14.2, v2.2.0, and v2.1.1.

:cve:`2020-10021`

Out-of-bounds write in USB Mass Storage with unaligned sizes

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes.

See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026

This has been fixed in releases v1.14.2, and v2.2.0.

:cve:`2020-10022`

UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case.

See NCC-ZEP-016

This has been fixed in the below pull requests for main, branch from v2.1.0, and branch from v2.2.0.

:cve:`2020-10023`

Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel.

See NCC-ZEP-019

This has been fixed in releases v1.14.2, v2.2.0, and in a branch from v2.1.0,

:cve:`2020-10024`

ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel.

See NCC-ZEP-001

This has been fixed in releases v1.14.2, and v2.2.0, and in a branch from v2.1.0,

:cve:`2020-10027`

ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel.

See NCC-ZEP-001

This has been fixed in releases v1.14.2, and v2.2.0, and in a branch from v2.1.0.

:cve:`2020-10028`

Multiple Syscalls In GPIO Subsystem Performs No Argument Validation

Multiple syscalls with insufficient argument validation

See NCC-ZEP-006

This has been fixed in releases v1.14.2, and v2.2.0, and in a branch from v2.1.0.

:cve:`2020-10058`

Multiple Syscalls In kscan Subsystem Performs No Argument Validation

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges.

See NCC-ZEP-006

This has been fixed in a branch from v2.1.0, and release v2.2.0.

:cve:`2020-10059`

UpdateHub Module Explicitly Disables TLS Verification

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking.

See NCC-ZEP-018

This has been fixed in a PR against Zephyr main.

:cve:`2020-10060`

UpdateHub Might Dereference An Uninitialized Pointer

In updatehub_probe, right after JSON parsing is complete, objects[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference uninitialized stack memory. This could result in a crash, denial of service, or possibly an information leak.

Recommend disabling updatehub until such a time as a fix can be made available.

See NCC-ZEP-030

This has been fixed in a PR against Zephyr main.

:cve:`2020-10061`

Error handling invalid packet sequence

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption.

This has been fixed in branches for v1.14.0, v2.2.0, and will be included in v2.3.0.

:cve:`2020-10062`

Packet length decoding error in MQTT

CVE: An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031

The MQTT packet header length can be 1 to 4 bytes. An off-by-one error in the code can result in this being interpreted as 5 bytes, which can cause an integer overflow, resulting in memory corruption.

This has been fixed in main for v2.3.

:cve:`2020-10063`

Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service.

This has been fixed in main for v2.3.

:cve:`2020-10064`

Improper Input Frame Validation in ieee802154 Processing

:cve:`2020-10065`

OOB Write after not validating user-supplied length (<= 0xffff) and copying to fixed-size buffer (default: 77 bytes) for HCI_ACL packets in bluetooth HCI over SPI driver.

:cve:`2020-10066`

Incorrect Error Handling in Bluetooth HCI core

In hci_cmd_done, the buf argument being passed as null causes nullpointer dereference.

:cve:`2020-10067`

Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel.

See NCC-ZEP-005

This has been fixed in releases v1.14.2, and v2.2.0.

:cve:`2020-10068`

Zephyr Bluetooth DLE duplicate requests vulnerability

In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service.

This has been fixed in branches for v1.14.0, v2.2.0, and will be included in v2.3.0.

:cve:`2020-10069`

Zephyr Bluetooth unchecked packet data results in denial of service

An unchecked parameter in bluetooth data can result in an assertion failure, or division by zero, resulting in a denial of service attack.

This has been fixed in branches for v1.14.0, v2.2.0, and will be included in v2.3.0.

:cve:`2020-10070`

MQTT buffer overflow on receive buffer

In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031

When calculating the packet length, arithmetic overflow can result in accepting a receive buffer larger than the available buffer space, resulting in user data being written beyond this buffer.

This has been fixed in main for v2.3.

:cve:`2020-10071`

Insufficient publish message length validation in MQTT

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031

This has been fixed in main for v2.3.

:cve:`2020-10072`

All threads can access all socket file descriptors

There is no management of permissions to network socket API file descriptors. Any thread running on the system may read/write a socket file descriptor knowing only the numerical value of the file descriptor.

:cve:`2020-10136`

IP-in-IP protocol routes arbitrary traffic by default zephyrproject

:cve:`2020-13598`

FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat

Performing fs_stat on a file with a filename longer than 12 characters long will cause a buffer overflow.

:cve:`2020-13599`

Security problem with settings and littlefs

When settings is used in combination with littlefs all security related information can be extracted from the device using MCUmgr and this could be used e.g in bt-mesh to get the device key, network key, app keys from the device.

:cve:`2020-13600`

Malformed SPI in response for eswifi can corrupt kernel memory

:cve:`2020-13601`

Possible read out of bounds in dns read

:cve:`2020-13602`

Remote Denial of Service in LwM2M do_write_op_tlv

In the Zephyr LwM2M implementation, malformed input can result in an infinite loop, resulting in a denial of service attack.

:cve:`2020-13603`

Possible overflow in mempool

  • Zephyr offers pre-built 'malloc' wrapper function instead.
  • The 'malloc' function is wrapper for the 'sys_mem_pool_alloc' function
  • sys_mem_pool_alloc allocates 'size + WB_UP(sizeof(struct sys_mem_pool_block))' in an unsafe manner.
  • Asking for very large size values leads to internal integer wrap-around.
  • Integer wrap-around leads to successful allocation of very small memory.
  • For example: calling malloc(0xffffffff) leads to successful allocation of 7 bytes.
  • That leads to heap overflow.

CVE-2021

:cve:`2021-3319`

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses

Improper processing of omitted source and destination addresses in ieee802154 frame validation (ieee802154_validate_frame)

This has been fixed in main for v2.5.0

:cve:`2021-3320`

Mismatch between validation and handling of 802154 ACK frames, where ACK frames are considered during validation, but not during actual processing, leading to a type confusion.

:cve:`2021-3321`

Incomplete check of minimum IEEE 802154 fragment size leading to an integer underflow.

:cve:`2021-3323`

Integer Underflow in 6LoWPAN IPHC Header Uncompression

This has been fixed in main for v2.5.0

:cve:`2021-3430`

Assertion reachable with repeated LL_CONNECTION_PARAM_REQ.

This has been fixed in main for v2.6.0

:cve:`2021-3431`

BT: Assertion failure on repeated LL_FEATURE_REQ

This has been fixed in main for v2.6.0

:cve:`2021-3432`

Invalid interval in CONNECT_IND leads to Division by Zero

This has been fixed in main for v2.6.0

:cve:`2021-3433`

BT: Invalid channel map in CONNECT_IND results to Deadlock

This has been fixed in main for v2.6.0

:cve:`2021-3434`

L2CAP: Stack based buffer overflow in le_ecred_conn_req()

This has been fixed in main for v2.6.0

:cve:`2021-3435`

L2CAP: Information leakage in le_ecred_conn_req()

This has been fixed in main for v2.6.0

:cve:`2021-3436`

Bluetooth: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known

During the distribution of the identity address information we don’t check for an existing bond with the same identity address.This means that a duplicate entry will be created in RAM while the newest entry will overwrite the existing one in persistent storage.

This has been fixed in main for v2.6.0

:cve:`2021-3454`

Truncated L2CAP K-frame causes assertion failure

For example, sending L2CAP K-frame where SDU length field is truncated to only one byte, causes assertion failure in previous releases of Zephyr. This has been fixed in master by commit 0ba9437 but has not yet been backported to older release branches.

This has been fixed in main for v2.6.0

:cve:`2021-3455`

Disconnecting L2CAP channel right after invalid ATT request leads freeze

When Central device connects to peripheral and creates L2CAP connection for Enhanced ATT, sending some invalid ATT request and disconnecting immediately causes freeze.

This has been fixed in main for v2.6.0

:cve:`2021-3510`

Zephyr JSON decoder incorrectly decodes array of array

When using JSON_OBJ_DESCR_ARRAY_ARRAY, the subarray is has the token type JSON_TOK_LIST_START, but then assigns to the object part of the union. arr_parse then takes the offset of the array-object (which has nothing todo with the list) treats it as relative to the parent object, and stores the length of the subarray in there.

This has been fixed in main for v2.7.0

:cve:`2021-3581`

HCI data not properly checked leads to memory overflow in the Bluetooth stack

In the process of setting SCAN_RSP through the HCI command, the Zephyr Bluetooth protocol stack did not effectively check the length of the incoming HCI data. Causes memory overflow, and then the data in the memory is overwritten, and may even cause arbitrary code execution.

This has been fixed in main for v2.6.0

:cve:`2021-3625`

Buffer overflow in Zephyr USB DFU DNLOAD

This has been fixed in main for v2.6.0

:cve:`2021-3835`

Buffer overflow in Zephyr USB device class

This has been fixed in main for v3.0.0

:cve:`2021-3861`

Buffer overflow in the RNDIS USB device class

This has been fixed in main for v3.0.0

:cve:`2021-3966`

Usb bluetooth device ACL read cb buffer overflow

This has been fixed in main for v3.0.0

CVE-2022

:cve:`2022-0553`

Possible to retrieve unencrypted firmware image

This has been fixed in main for v3.0.0

:cve:`2022-1041`

Out-of-bound write vulnerability in the Bluetooth Mesh core stack can be triggered during provisioning

This has been fixed in main for v3.1.0

:cve:`2022-1042`

Out-of-bound write vulnerability in the Bluetooth Mesh core stack can be triggered during provisioning

This has been fixed in main for v3.1.0

:cve:`2022-1841`

Out-of-Bound Write in tcp_flags

This has been fixed in main for v3.1.0

:cve:`2022-2741`

can: denial-of-service can be triggered by a crafted CAN frame

This has been fixed in main for v3.2.0

:cve:`2022-2993`

bt: host: Wrong key validation check

This has been fixed in main for v3.2.0

:cve:`2022-3806`

DoS: Invalid Initialization in le_read_buffer_size_complete()

CVE-2023

:cve:`2023-0396`

Buffer Overreads in Bluetooth HCI

:cve:`2023-0397`

DoS: Invalid Initialization in le_read_buffer_size_complete()

This has been fixed in main for v3.3.0

:cve:`2023-0779`

net: shell: Improper input validation

This has been fixed in main for v3.3.0

:cve:`2023-1901`

HCI send_sync Dangling Semaphore Reference Re-use

This has been fixed in main for v3.4.0

:cve:`2023-1902`

HCI Connection Creation Dangling State Reference Re-use

This has been fixed in main for v3.4.0

:cve:`2023-3725`

Potential buffer overflow vulnerability in the Zephyr CANbus subsystem.

This has been fixed in main for v3.5.0

:cve:`2023-4257`

Unchecked user input length in the Zephyr WiFi shell module can cause buffer overflows.

This has been fixed in main for v3.5.0

:cve:`2023-4258`

bt: mesh: vulnerability in provisioning protocol implementation on provisionee side

This has been fixed in main for v3.5.0

:cve:`2023-4259`

Buffer overflow vulnerabilities in the Zephyr eS-WiFi driver

This has been fixed in main for v3.5.0

:cve:`2023-4260`

Off-by-one buffer overflow vulnerability in the Zephyr FS subsystem

This has been fixed in main for v3.5.0

:cve:`2023-4262`

  • This issue has been determined to be a false positive after further analysis.

:cve:`2023-4263`

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver.

This has been fixed in main for v3.5.0

:cve:`2023-4264`

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

This has been fixed in main for v3.5.0

:cve:`2023-4265`

Two potential buffer overflow vulnerabilities in Zephyr USB code

This has been fixed in main for v3.4.0

:cve:`2023-4424`

bt: hci: DoS and possible RCE

This has been fixed in main for v3.5.0

:cve:`2023-5055`

L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()

This has been fixed in main for v3.5.0

:cve:`2023-5139`

Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver.

This has been fixed in main for v3.5.0

:cve:`2023-5184`

Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver

This has been fixed in main for v3.5.0

:cve:`2023-5563`

The SJA1000 CAN controller driver backend automatically attempts to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

This has been fixed in main for v3.5.0

:cve:`2023-5753`

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem source code when asserts are disabled.

This has been fixed in main for v3.5.0

:cve:`2023-5779`

Out of bounds issue in remove_rx_filter in multiple can drivers.

This has been fixed in main for v3.6.0

:cve:`2023-6249`

Signed to unsigned conversion problem in esp32_ipm_send may lead to buffer overflow

This has been fixed in main for v3.6.0

:cve:`2023-6749`

Potential buffer overflow due unchecked data coming from user input in settings shell.

This has been fixed in main for v3.6.0

:cve:`2023-6881`

Potential buffer overflow vulnerability in Zephyr fuse file system.

This has been fixed in main for v3.6.0

:cve:`2023-7060`

Missing Security Control in Zephyr OS IP Packet Handling

This has been fixed in main for v3.6.0

CVE-2024

:cve:`2024-1638`

Bluetooth characteristic LESC security requirement not enforced without additional flags

This has been fixed in main for v3.6.0

:cve:`2024-3077`

Bluetooth: Integer underflow in gatt_find_info_rsp. A malicious Bluetooth LE device can crash Bluetooth LE victim device by sending malformed gatt packet.

This has been fixed in main for v3.7.0

:cve:`2024-3332`

Bluetooth: DoS caused by null pointer dereference.

A malicious Bluetooth LE device can send a specific order of packet sequence to cause a DoS attack on the victim Bluetooth LE device.

This has been fixed in main for v3.7.0

:cve:`2024-4785`

Bluetooth: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

This has been fixed in main for v3.7.0

:cve:`2024-5754`

BT: Encryption procedure host vulnerability

This has been fixed in main for v3.7.0

:cve:`2024-5931`

BT: Unchecked user input in bap_broadcast_assistant

This has been fixed in main for v3.7.0

:cve:`2024-6135`

BT:Classic: Multiple missing buf length checks

This has been fixed in main for v3.7.0

:cve:`2024-6137`

BT: Classic: SDP OOB access in get_att_search_list

This has been fixed in main for v3.7.0

:cve:`2024-6258`

BT: Missing length checks of net_buf in rfcomm_handle_data

This has been fixed in main for v3.7.0

:cve:`2024-6259`

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

This has been fixed in main for v3.7.0

:cve:`2024-6442`

Bluetooth: ASCS Unchecked tailroom of the response buffer

This has been fixed in main for v3.7.0

:cve:`2024-6443`

zephyr: out-of-bound read in utf8_trunc

This has been fixed in main for v3.7.0

:cve:`2024-6444`

Bluetooth: ots: missing buffer length check

This has been fixed in main for v3.7.0

:cve:`2024-8798`

Bluetooth: classic: avdtp: missing buffer length check

This has been fixed in main for v4.0.0

:cve:`2024-10395`

net: lib: http_server: Buffer Under-read

No proper validation of the length of user input in http_server_get_content_type_from_extension could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer.

This has been fixed in main for v4.0.0

:cve:`2024-11263`

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

A rogue thread can corrupt the gp reg and cause the entire system to hard fault at best, at worst, it can potentially trick the system to access another set of random global symbols.

This has been fixed in main for v4.0.0

:cve:`2025-1673`

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.

This has been fixed in main for v4.1.0

:cve:`2025-1674`

Out of bounds read when unpacking DNS answers

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.

This has been fixed in main for v4.1.0

:cve:`2025-1675`

Out of bounds read in dns_copy_qname

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

This has been fixed in main for v4.1.0

:cve:`2025-2962`

Under embargo until 2025-06-07