Zephyr vulnerabilities

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device initiates teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() calls rfcomm_session_disconnected(), which unconditionally forces the session to BT_RFCOMM_STATE_DISCONNECTED without calling bt_l2cap_chan_disconnect(). This permanently wedges the session: the L2CAP channel is never released and the session slot in the bt_rfcomm_pool[] array is never reclaimed.

In Zephyr's BSD-sockets getaddrinfo() implementation, a use-after-return vulnerability occurs when a semaphore wait times out. The code retries the DNS query without canceling the previous one, leaving a stack pointer as user_data. A delayed DNS response or resolver timeout can overwrite stack memory, causing crashes or memory corruption.

In Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client, a NULL pointer dereference vulnerability exists. The unicast_client_ep_qos_state() function writes attacker-controlled QoS fields through the stream->qos pointer, which can be NULL when the stream is codec-configured but not added to a unicast group. A remote ASCS server can send a GATT notification announcing QoS Configured state while the local endpoint is in Codec Configured state, causing a write through NULL and a system crash.

In Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c), there is an out-of-bounds write vulnerability in the control buffer (msg_control). The validation only checks the payload length (msg_controllen < pktinfo_len), omitting the cmsg header size, allowing a write of up to 12 bytes past the buffer.

The IPv6 stack in Zephyr can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.

A vulnerability in the Zephyr Bluetooth stack (subsys/bluetooth/host/iso.c) allows a malicious controller or adjacent BLE peer to send a short ISO packet, causing an out-of-bounds buffer read and, in the fragmented case, an out-of-bounds write. The issue exists from v2.6.0 to v4.4.0 and affects builds with ISO receive enabled (CONFIG_BT_ISO_RX).

A buffer over-read vulnerability was found in the Bluetooth BR/EDR stack of Zephyr in the bt_sdp_parse_attribute() function. An attacker can send a specially crafted SDP record of exactly 3 bytes, causing a one-byte read past the end of the buffer. Affects versions 4.3.0 and 4.4.0; fixed by adding proper length checks.

A buffer overflow vulnerability exists in Zephyr's Bluetooth Classic Hands-Free Profile (HFP) driver. The cind_handle_values() function fails to validate the index against the 20-element ind_table[] array, allowing a remote attacker (malicious AG) to write a controlled value out of bounds, causing memory corruption and potential denial of service of the Bluetooth stack.

A use-after-free vulnerability was found in Zephyr's IPv6 Neighbor Discovery send paths (NA, NS, RS). After a packet is successfully sent, the code accesses the already-freed packet structure, potentially causing a system crash or limited memory corruption.

A use-after-free vulnerability exists in Zephyr's native IPv4 stack in icmpv4_handle_echo_request(). After sending an ICMP Echo Reply, the code reads the interface pointer from a freed packet, potentially causing memory read or write via a stale pointer. The issue is present from v1.14 (2019) to v4.4.0.

A use-after-free vulnerability exists in Zephyr's networking stack (subsys/net/ip/icmpv6.c) when handling ICMPv6 packets. After sending an echo reply or ICMPv6 error, the code reads the network interface from a freed packet, leading to a dangling pointer dereference.

In the Zephyr network stack, the mld_send() function reads the network interface from a packet after it has been freed by the L2 driver. This can lead to a use-after-free condition, potentially causing a NULL-pointer dereference or memory corruption if the freed slot is concurrently reallocated.

In Zephyr's IPv4 IGMP implementation, a use-after-free vulnerability exists in igmp_send() which reads the network interface pointer after the packet has been sent. This affects versions from v2.6.0 through v4.4.0.

In Zephyr OS on Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, arch_mem_domain_deinit() fails to remove the domain node from the global xtensa_domain_list, leaving a dangling pointer. Subsequent memory mapping/unmapping operations may trigger NULL pointer dereference or use-after-free, causing system crash or userspace isolation breach.

A use-after-free vulnerability exists in Zephyr's native TCP stack (TCP2) in the net_tcp_foreach() function. The function releases the tcp_lock while invoking a per-connection callback, allowing a concurrent thread to free the cached next connection. When the iterator resumes, it dereferences freed slab memory, potentially causing a system crash (denial of service) or, if the memory is reused, allowing an attacker-influenced object to be processed (information disclosure).

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes via crafted PTP messages.

In Zephyr, sockets created with `IPPROTO_TLS_1_3` can negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS. Applications assuming `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses.

A flaw in Zephyr's network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the networking subsystem.