fs: fuse: buffer overflow vulnerability in the Zephyr FS

Possible buffer overflow in is_mount_point

ipm: signed to unsigned conversion problem in esp32_ipm_send

Signed to unsigned conversion esp32_ipm_send

can: out of bounds in remove_rx_filter function

can: out of bounds in remove_rx_filter function

Unchecked user input length in the Zephyr Settings Shell

Unchecked length coming from user input in settings shell

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()

Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.

bt: hci: DoS and possible RCE

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.

bt: mesh: vulnerability in provisioning protocol implementation on provisionee side

In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.

BT HCI host union variant confusion

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

HCI Connection Creation Dangling State Reference Re-use

The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.

HCI send_sync Dangling Semaphore Reference Re-use

The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.

ipv6: Missing ipv6 nullptr-check in handle_ra_input

A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

Out-of-bound write in tcp_flags

In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.

Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.

Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.

The RNDIS USB device class includes a buffer overflow vulnerability

The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj

Buffer overflow in usb device class

Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf

Buffer overflow in Zephyr USB DFU DNLOAD

Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363

Buffer Access with Incorrect Length Value in zephyr

Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8q65-5gqf-fmw5

Zephyr JSON decoder incorrectly decodes array of array

Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4