Zephyr RTOS vulnerabilities

A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.

A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.

In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.

A vulnerability in the Zephyr RTOS kernel allows an unprivileged user-mode thread to perform an out-of-bounds write in kernel memory. It stems from missing overflow checks when calculating allocation sizes for dynamic kernel objects, leading to undersized heap allocations. An attacker can exploit this to escalate privileges and execute arbitrary code at the kernel level.

A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.

A vulnerability in the SMP-over-console transport in Zephyr RTOS allows an unauthenticated attacker to trigger a buffer length underflow by sending a single 7-byte frame to the management console. This leads to an out-of-bounds read, potentially causing a denial of service on the MCUmgr thread or memory disclosure.

In Zephyr RTOS, a vulnerability exists in the BSD socket layer where an asynchronous error was stored in the user_data field of the network context, which for listening TCP sockets is used to store a pointer to the parent context. In v4.3.0, after an interface-down event, the accept callback was not disarmed, leading to reuse of the poisoned value as a pointer and writes to an invalid address, causing a kernel fatal error (device crash or reset).

A vulnerability in the RTIO syscall verifier in Zephyr RTOS (before v4.3.0) allows an unprivileged user thread to write a pointer to controlled data at an arbitrary kernel address. The missing K_SYSCALL_MEMORY_WRITE check for the handle output parameter enables privilege escalation to kernel mode.

The gptp_mi_qualify_announce() function in Zephyr's gPTP subsystem processes received Announce messages by comparing clock identities. The comparison loop uses an attacker-controlled step count (steps_removed) instead of the actual number of TLV entries, leading to an out-of-bounds read. A single frame can cause about 2KB of overread, potentially crashing the networking RX thread and causing denial of service.

The gptp_handle_msg() function in Zephyr RTOS does not validate the received frame length before dereferencing the gPTP header pointer. A truncated frame can lead to out-of-bounds reads, disclosing stale memory contents.

A vulnerability in Zephyr RTOS causes network buffer (net_pkt) leaks when Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE). Frames with unrecognized EtherType that are also delivered to the local stack are marked as NET_OK, which is interpreted as consumed, but they are never freed. An attacker on the L2 segment can flood broadcast/multicast frames with arbitrary EtherType, exhausting the RX buffer pool and causing a persistent denial of service until reboot.

A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.

A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.

Vulnerability in IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c) in Zephyr RTOS. The handle_ra_6co() function does not bound the context_len field from the 6CO option in Router Advertisements, leading to a buffer overflow and out-of-bounds memset. An attacker on the same link can send a crafted packet causing a system crash.

A vulnerability in the flash_copy() system call in Zephyr RTOS (with CONFIG_USERSPACE enabled) allows an unprivileged thread to pass forged pointers to flash device structures. Lack of device object validation (src_dev, dst_dev) before dereferencing enables arbitrary code execution in supervisor mode, leading to privilege escalation outside the userspace sandbox.

The vulnerability in Zephyr RTOS concerns the system-call verifier z_vrfy_z_log_msg_static_create(), which did not validate arguments passed to the kernel function. This allows an unprivileged user thread to supply arbitrary pointers and lengths, leading to kernel memory reads and system crashes.

The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly.

The vulnerability in the UpdateHub subsystem (subsys/mgmt/updatehub/updatehub.c) is due to unsynchronized access to the shared ctx structure. Concurrent operations (background autohandler and user-triggered calls) can write past the fds[1] array, overwriting adjacent struct fields, leading to internal state corruption and denial of service in the firmware update path.

The hawkBit device management client in Zephyr RTOS has a heap-based out-of-bounds write vulnerability. The response buffer lacks space for a terminating null byte, causing a single null byte write past the allocated memory when the response length matches the buffer size.

In the OCPP 1.6 client in Zephyr RTOS, a vulnerability was found involving out-of-bounds buffer read during WAMP RPC frame parsing. The extract_string_field() function uses strncpy without guaranteed null-termination, leading to reads beyond the 128-byte buffer and potential out-of-bounds null write. The vulnerability can be remotely exploited by a malicious central server or an on-path attacker.

In Zephyr RTOS versions v3.3.0 through v4.4.1, the userspace verifier function z_vrfy_log_filter_set() performs a signed comparison for the src_id parameter, allowing negative values to be passed. This leads to out-of-bounds read and write in the log_dynamic array, which can be exploited for privilege escalation in supervisor mode.

A vulnerability in the Bluetooth BR/EDR (Classic) stack of Zephyr RTOS affects L2CAP configuration handlers (l2cap_br_conf_req and l2cap_br_conf_rsp). The minimum command size validation used buf->len (bytes remaining in the whole PDU) instead of len (per-command data length from the L2CAP header). An attacker can send a CONF_REQ command with a header smaller than the configuration-request structure (e.g., 0) followed by another command, causing buf->len to still pass the check. This leads to an underflow of opt_len to near 0xFFFF, resulting in an out-of-bounds read and potential out-of-bounds write when option bytes encode MTU or flush-timeout.

A vulnerability in the LwM2M library of Zephyr RTOS copies the firmware-update Package URI into a fixed buffer without length validation. An attacker can write a URI of 128-254 characters, causing an out-of-bounds read of adjacent static memory, information disclosure, and potential device crash.

In Zephyr RTOS, the CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call calls k_object_find() on a user-supplied thread pointer and dereferences the returned struct without NULL check. If the pointer is not a registered kernel object, a NULL dereference occurs in supervisor mode, causing a system crash or reboot.

A vulnerability in the Bluetooth BAP Broadcast Assistant GATT client in Zephyr RTOS causes buffer overflow and cross-connection data corruption. A shared 512-byte buffer for all connection instances, combined with concurrent notifications from multiple Scan Delegator devices, can lead to out-of-bounds writes and data mixing between connections.

A vulnerability in Zephyr RTOS affects IPv6 Neighbor Discovery handlers. Incorrect boolean logic causes all RFC 4861 validity checks (including the mandatory Hop Limit == 255) to be bypassed when the ICMPv6 code field is 0 (normal for ND). This allows an attacker to inject forged RA/NS/NA messages.

The USB CDC-NCM driver in Zephyr RTOS ignores the return value of usbd_ep_enqueue(). When enqueue fails (e.g., during USB bus suspend), the function blocks on a semaphore that never signals, causing a permanent deadlock of the TX thread and halting network transmission until reboot.

In the Zephyr RTOS network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c), a potential out-of-bounds write/read exists in the TLS socket connect path. When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. This can lead to reading and writing past the end of the address memory, potentially causing a crash and denial of service, and possibly arbitrary code execution.