The UpdateHub OTA client in Zephyr's subsys/mgmt/updatehub/updatehub.c has a memory safety issue in z_impl_updatehub_probe(). When the probe response from the UpdateHub server is copied into a heap buffer (metadata) and then into a second uninitialized buffer (metadata_copy) without zeroing, the strlen() call on metadata_copy can read past the allocated buffer if no terminating NUL byte is found. This leads to an out-of-bounds read of uninitialized heap memory. The probe payload is attacker-controlled, allowing a crafted payload to trigger this condition. The impact is a network-triggerable denial of service via a crash of the update thread or device. The vulnerability does not cause information disclosure or memory corruption. The fix involves zeroing metadata_copy before copying to ensure proper NUL termination and bounded strlen().

An attacker controlling or intercepting the UpdateHub server response can cause the UpdateHub client to read uninitialized heap memory beyond the allocated buffer, potentially causing a crash of the update thread or the entire device. This results in a denial of service condition. There is no direct information disclosure or memory corruption. The vulnerability requires network access to the UpdateHub server component and has a low severity impact (CVSS 3.7).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix zeroes the metadata_copy buffer before copying to ensure proper NUL termination and prevent out-of-bounds reads. Until an official patch is available, consider restricting network access to the UpdateHub server or enabling optional security features such as CONFIG_UPDATEHUB_DTLS to prevent on-path attackers from manipulating the probe payload.