CVE-2026-13479: bounds in zephyrproject zephyr

The LoRaWAN application-layer clock-synchronization service in Zephyr parses downlink messages in clock_sync_package_callback(). While the command loop ensures the one-byte command ID is in bounds, the handler for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command reads a 4-byte time correction and a 1-byte token without verifying that 5 bytes remain in the receive buffer. This results in a bounded over-read of up to 5 bytes past the decrypted payload. The payload is delivered only after passing MAC integrity and decryption, so only a malicious or compromised network/application server or an entity with session keys can exploit this. The over-read does not cause crashes or data leaks, but may cause the device to apply an incorrect time offset, affecting clock integrity. The vulnerability affects Zephyr versions 3.3.0 and all versions from 3.3.0 up to but not including 4.4.2. The fix adds an explicit length check to reject too-short AppTimeAns messages.

The vulnerability does not lead to data disclosure, crashes, or denial of service. Its impact is limited to a minor integrity issue where a stale or crafted token can cause the device to apply an incorrect time correction to its clock offset. This affects the accuracy of the device's time estimate but does not compromise confidentiality or availability. Exploitation requires privileged access to the network/application server or session keys, limiting the threat scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds an explicit length check to drop too-short AppTimeAns messages, which mitigates the vulnerability. Until an official fix is available, be aware that exploitation requires a malicious or compromised network/application server or possession of session keys, which limits practical risk.