Vendor
zephyrproject-rtos
131 known vulnerabilities.
Products
131 results · Feed
-
High 7.6
BT:Classic: Multiple missing buf length checks
BT:Classic: Multiple missing buf length checks
-
Medium 6.3
BT: Unchecked user input in bap_broadcast_assistant
BT: Unchecked user input in bap_broadcast_assistant
-
Medium 6.8
BT: Missing length checks of net_buf in rfcomm_handle_data
BT: Missing length checks of net_buf in rfcomm_handle_data
-
High 8.2
BT: Encryption procedure host vulnerability
BT: Encryption procedure host vulnerability
-
High 7.6
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
-
Medium 6.5
bt: host/smp: DoS caused by null pointer dereference
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
-
Medium 6.8
Bluetooth: integer underflow in gatt_find_info_rsp
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
-
High 8.6
Missing Security Control in Zephyr OS IP Packet Handling
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
-
High 7.3
fs: fuse: buffer overflow vulnerability in the Zephyr FS
Possible buffer overflow in is_mount_point
-
High 8.2
Bluetooth characteristic LESC security requirement not enforced without additional flags
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/…
-
Medium 4.4
can: out of bounds in remove_rx_filter function
can: out of bounds in remove_rx_filter function
-
High 8.0
ipm: signed to unsigned conversion problem in esp32_ipm_send
Signed to unsigned conversion esp32_ipm_send
-
High 8.0
Unchecked user input length in the Zephyr Settings Shell
Unchecked length coming from user input in settings shell
-
High 8.3
L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
-
High 8.3
bt: hci: DoS and possible RCE
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
-
Medium 4.4
Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
-
Medium 6.3
Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
-
High 7.6
Unchecked user input length in the Zephyr WiFi shell module
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
-
High 7.6
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
-
High 7.1
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_…
-
High 7.6
Potential buffer overflow vulnerability in the Zephyr CANbus subsystem
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
-
High 7.0
Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
-
Medium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
-
High 7.1
Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
-
High 7.1
Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
-
High 8.6
bt: mesh: vulnerability in provisioning protocol implementation on provisionee side
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
-
Medium 6.4
Buffer overflow in Zephyr USB
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_…
-
Medium 5.9
HCI send_sync Dangling Semaphore Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential R…
-
Medium 6.8
BT HCI host union variant confusion
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
-
Medium 5.9
HCI Connection Creation Dangling State Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE o…
-
Medium 5.9
ipv6: Missing ipv6 nullptr-check in handle_ra_input
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
-
Medium 6.7
net: shell: Improper input validation
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
-
Critical 9.6
DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
-
Medium 6.8
Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
-
Critical 9.6
DoS: Invalid Initialization in le_read_buffer_size_complete
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
-
Critical 9.8
Bluetooth HCI Error Handling Double Free
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
-
Medium 6.5
Possible to retrieve uncrypted firmware image
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
-
Critical 9.6
Usb bluetooth device ACL read cb buffer overflow
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
-
High 8.6
bt: host: Wrong key validation check
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
-
High 8.2
can: denial-of-service can be triggered by a crafted CAN frame
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traf…