Vendor
zephyrproject-rtos
136 known vulnerabilities.
Products
61 results · Clear filters · Feed
-
High 7.8
The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the pr…
-
High 7.8
The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with…
-
High 8.3
The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a…
-
High 7.5
net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network…
-
High 7.6
bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2…
-
High 7.3
net: eswifi socket send payload length not bounded
The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no …
-
High 7.6
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
-
High 7.6
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start
There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.
-
High 8.2
Userspace privilege escalation vulnerability on Cortex M
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
-
High 7.1
Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channe…
-
High 7.6
Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values
Parameters are not validated or sanitized, and are later used in various internal operations.
-
High 7.6
Bluetooth: bt_conn_tx_processor unsafe handling
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
-
High 8.2
Infinite loop in dns_copy_qname
A denial-of-service issue in the dns implemenation could cause an infinite loop.
-
High 8.2
Out of bounds read in dns_copy_qname
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
-
High 8.2
Out of bounds read when unpacking DNS answers
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
-
High 8.2
Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
-
High 8.6
net: lib: http_server: Buffer Under-read
No proper validation of the length of user input in http_server_get_content_type_from_extension.
-
High 7.5
Bluetooth: classic: avdtp: missing buffer length check
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
-
High 7.6
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
-
High 7.6
BT: Classic: SDP OOB access in get_att_search_list
BT: Classic: SDP OOB access in get_att_search_list
-
High 7.6
BT:Classic: Multiple missing buf length checks
BT:Classic: Multiple missing buf length checks
-
High 8.2
BT: Encryption procedure host vulnerability
BT: Encryption procedure host vulnerability
-
High 7.6
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
-
High 8.6
Missing Security Control in Zephyr OS IP Packet Handling
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
-
High 7.3
fs: fuse: buffer overflow vulnerability in the Zephyr FS
Possible buffer overflow in is_mount_point
-
High 8.2
Bluetooth characteristic LESC security requirement not enforced without additional flags
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/…
-
High 8.0
ipm: signed to unsigned conversion problem in esp32_ipm_send
Signed to unsigned conversion esp32_ipm_send
-
High 8.0
Unchecked user input length in the Zephyr Settings Shell
Unchecked length coming from user input in settings shell
-
High 8.3
L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
-
High 8.3
bt: hci: DoS and possible RCE
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
-
High 7.6
Unchecked user input length in the Zephyr WiFi shell module
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
-
High 7.6
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
-
High 7.1
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_…
-
High 7.6
Potential buffer overflow vulnerability in the Zephyr CANbus subsystem
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
-
High 7.0
Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
-
High 7.1
Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
-
High 7.1
Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
-
High 8.6
bt: mesh: vulnerability in provisioning protocol implementation on provisionee side
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
-
High 8.6
bt: host: Wrong key validation check
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
-
High 8.2
can: denial-of-service can be triggered by a crafted CAN frame
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traf…