Zephyr RTOS vulnerabilities

A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.

A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.

Vulnerability in IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c) in Zephyr RTOS. The handle_ra_6co() function does not bound the context_len field from the 6CO option in Router Advertisements, leading to a buffer overflow and out-of-bounds memset. An attacker on the same link can send a crafted packet causing a system crash.

A vulnerability in the flash_copy() system call in Zephyr RTOS (with CONFIG_USERSPACE enabled) allows an unprivileged thread to pass forged pointers to flash device structures. Lack of device object validation (src_dev, dst_dev) before dereferencing enables arbitrary code execution in supervisor mode, leading to privilege escalation outside the userspace sandbox.

The vulnerability in Zephyr RTOS concerns the system-call verifier z_vrfy_z_log_msg_static_create(), which did not validate arguments passed to the kernel function. This allows an unprivileged user thread to supply arbitrary pointers and lengths, leading to kernel memory reads and system crashes.

The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly.

The vulnerability in the UpdateHub subsystem (subsys/mgmt/updatehub/updatehub.c) is due to unsynchronized access to the shared ctx structure. Concurrent operations (background autohandler and user-triggered calls) can write past the fds[1] array, overwriting adjacent struct fields, leading to internal state corruption and denial of service in the firmware update path.

The hawkBit device management client in Zephyr RTOS has a heap-based out-of-bounds write vulnerability. The response buffer lacks space for a terminating null byte, causing a single null byte write past the allocated memory when the response length matches the buffer size.

In the OCPP 1.6 client in Zephyr RTOS, a vulnerability was found involving out-of-bounds buffer read during WAMP RPC frame parsing. The extract_string_field() function uses strncpy without guaranteed null-termination, leading to reads beyond the 128-byte buffer and potential out-of-bounds null write. The vulnerability can be remotely exploited by a malicious central server or an on-path attacker.

In Zephyr RTOS versions v3.3.0 through v4.4.1, the userspace verifier function z_vrfy_log_filter_set() performs a signed comparison for the src_id parameter, allowing negative values to be passed. This leads to out-of-bounds read and write in the log_dynamic array, which can be exploited for privilege escalation in supervisor mode.

A vulnerability in the Bluetooth BR/EDR (Classic) stack of Zephyr RTOS affects L2CAP configuration handlers (l2cap_br_conf_req and l2cap_br_conf_rsp). The minimum command size validation used buf->len (bytes remaining in the whole PDU) instead of len (per-command data length from the L2CAP header). An attacker can send a CONF_REQ command with a header smaller than the configuration-request structure (e.g., 0) followed by another command, causing buf->len to still pass the check. This leads to an underflow of opt_len to near 0xFFFF, resulting in an out-of-bounds read and potential out-of-bounds write when option bytes encode MTU or flush-timeout.

A vulnerability in the LwM2M library of Zephyr RTOS copies the firmware-update Package URI into a fixed buffer without length validation. An attacker can write a URI of 128-254 characters, causing an out-of-bounds read of adjacent static memory, information disclosure, and potential device crash.

In Zephyr RTOS, the CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call calls k_object_find() on a user-supplied thread pointer and dereferences the returned struct without NULL check. If the pointer is not a registered kernel object, a NULL dereference occurs in supervisor mode, causing a system crash or reboot.

A vulnerability in the Bluetooth BAP Broadcast Assistant GATT client in Zephyr RTOS causes buffer overflow and cross-connection data corruption. A shared 512-byte buffer for all connection instances, combined with concurrent notifications from multiple Scan Delegator devices, can lead to out-of-bounds writes and data mixing between connections.

A vulnerability in Zephyr RTOS affects IPv6 Neighbor Discovery handlers. Incorrect boolean logic causes all RFC 4861 validity checks (including the mandatory Hop Limit == 255) to be bypassed when the ICMPv6 code field is 0 (normal for ND). This allows an attacker to inject forged RA/NS/NA messages.

The USB CDC-NCM driver in Zephyr RTOS ignores the return value of usbd_ep_enqueue(). When enqueue fails (e.g., during USB bus suspend), the function blocks on a semaphore that never signals, causing a permanent deadlock of the TX thread and halting network transmission until reboot.

In the Zephyr RTOS network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c), a potential out-of-bounds write/read exists in the TLS socket connect path. When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. This can lead to reading and writing past the end of the address memory, potentially causing a crash and denial of service, and possibly arbitrary code execution.