CVE-2026-13481: bounds in zephyrproject zephyr

The IEEE 1588 PTP management-message parser in Zephyr's subsys/net/lib/ptp/tlv.c improperly handles the PTP_MGMT_TIME management ID by casting the TLV data to a 10-byte struct ptp_timestamp and reading/writing it without verifying that the TLV data length is sufficient. While other management IDs validate length first, PTP_MGMT_TIME lacks this check, allowing a peer on the local PTP segment to send a PTP_MSG_MANAGEMENT message with a short TLV data field (as small as 2 bytes). This causes an out-of-bounds read and a bounded write-back within the same message buffer, leading to minor information exposure and corruption of the parsed timestamp. The vulnerability does not cause crashes or reference-count corruption. The fix adds a length check returning an error if the TLV data is too short, aligning with other management ID cases and closing the defect.

An adjacent attacker on the local PTP segment can exploit this vulnerability to cause an out-of-bounds read of adjacent in-object memory and a bounded corruption of the parsed timestamp in the PTP management message. This results in minor information disclosure of adjacent bytes and corruption of the device's parsed management TIME value. There is no crash or broader memory corruption, and no reference-count corruption is reachable through this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding a length check before processing the PTP_MGMT_TIME TLV data to prevent out-of-bounds access. Until an official fix is available, disabling CONFIG_PTP or restricting access to the local PTP segment may reduce exposure.