Zephyrproject ≫ Zephyr

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.

Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_...

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or po...

The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potent...

A missing nullptr-check in handle_ra_input can cause a nullptr-deref.