In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.

Infinite loop in dns_copy_qname

A denial-of-service issue in the dns implemenation could cause an infinite loop.

Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

Parameters are not validated or sanitized, and are later used in various internal operations.

Bluetooth: bt_conn_tx_processor unsafe handling

Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.

net: lib: http_server: Buffer Under-read

No proper validation of the length of user input in http_server_get_content_type_from_extension.

BT: Encryption procedure host vulnerability

BT: Encryption procedure host vulnerability

BT: Classic: SDP OOB access in get_att_search_list

BT: Classic: SDP OOB access in get_att_search_list

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

Bluetooth: classic: avdtp: missing buffer length check

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.

BT: Missing length checks of net_buf in rfcomm_handle_data

BT: Missing length checks of net_buf in rfcomm_handle_data

BT: Unchecked user input in bap_broadcast_assistant

BT: Unchecked user input in bap_broadcast_assistant

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.

Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

can: denial-of-service can be triggered by a crafted CAN frame

The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).

Bluetooth characteristic LESC security requirement not enforced without additional flags

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.