Medium · 4.3 CVE-2021-3455 EUVD-2021-26778

Disconnecting L2CAP channel right after invalid ATT request leads freeze

Published Oct 19, 2021 · Updated Sep 16, 2024 · Assigned by zephyr

Description

Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vp

Vendor	Product	Affected	Fixed
zephyrproject-rtos	zephyr	2.4.0 – < unspecified, 2.5.0 – < unspecified	unspecified