Zephyr vulnerabilities

A use-after-free vulnerability exists in Zephyr's native TCP stack (TCP2) in the net_tcp_foreach() function. The function releases the tcp_lock while invoking a per-connection callback, allowing a concurrent thread to free the cached next connection. When the iterator resumes, it dereferences freed slab memory, potentially causing a system crash (denial of service) or, if the memory is reused, allowing an attacker-influenced object to be processed (information disclosure).

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes via crafted PTP messages.

In Zephyr, sockets created with `IPPROTO_TLS_1_3` can negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS. Applications assuming `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses.