Zephyrproject-Rtos Zephyr vulnerabilities

CVE-2023-4424 [HIGH] CWE-190 CVE-2023-4424: An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.

CVE-2023-5055 [MEDIUM] CWE-121 L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req() L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req() Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.

CVE-2023-5139 [HIGH] CWE-120 CVE-2023-5139: Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

CVE-2023-5753 [HIGH] CWE-120 CVE-2023-5753: Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluet Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c

CVE-2023-4257 [CRITICAL] CWE-120 CVE-2023-4257: Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.

CVE-2023-5563 [HIGH] CWE-703 CVE-2023-5563: The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

CVE-2023-4263 [HIGH] CWE-120 CVE-2023-4263: Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

CVE-2023-3725 [CRITICAL] CWE-120 CVE-2023-3725: Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

CVE-2023-4264 [CRITICAL] CWE-120 CVE-2023-4264: Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.

CVE-2023-4260 [CRITICAL] CWE-120 CVE-2023-4260: Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

CVE-2023-5184 [HIGH] CWE-120 CVE-2023-5184: Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the follow Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

CVE-2023-4259 [HIGH] CWE-120 CVE-2023-4259: Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi drive Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

CVE-2023-4258 [MEDIUM] CWE-684 CVE-2023-4258: In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provis In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.

CVE-2023-4265 [MEDIUM] CWE-120 CVE-2023-4265: Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproj Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/ne

CVE-2023-1901 [HIGH] CWE-787 CVE-2023-1901: The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronousl The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.

CVE-2023-2234 [HIGH] CWE-843 CVE-2023-2234: Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr h Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

CVE-2023-1902 [HIGH] CWE-416 CVE-2023-1902: The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.

CVE-2023-0359 [HIGH] CWE-20 CVE-2023-0359: A missing nullptr-check in handle_ra_input can cause a nullptr-deref. A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

CVE-2023-0779 [HIGH] CWE-20 CVE-2023-0779: At the most basic level, an invalid pointer can be input that crashes the device, but with more know At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.

CVE-2021-3329 [MEDIUM] CWE-703 CVE-2021-3329: Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack