Threats affecting pkg:github/zephyr

Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the `TLS_CIPHERSUITE_LIST` socket option can be restricted to TLS 1.3-only cipher suites.

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.

Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the networking subsystem.

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

CVE-2025-10456 is a high-severity integer overflow or wraparound vulnerability in the Zephyr RTOS Bluetooth Low Energy (BLE) stack. It arises from improper handling of BLE fixed channels such as SMP or ATT, where disconnection attempts on these fixed channels can cause undefined behavior including assertion failures, crashes, or memory corruption. This affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.3.0.

CVE-2025-10458 is a high severity vulnerability in Zephyr RTOS involving improper handling of length parameters due to lack of validation or sanitization. This flaw affects versions prior to 4.3.0 and can impact system confidentiality, integrity, and availability. No exploit is currently known in the wild and no patch information is provided.

CVE-2025-7403 is a high-severity vulnerability in Zephyr RTOS versions prior to 4.2.0. It involves unsafe handling in the bt_conn_tx_processor component, causing a use-after-free condition that leads to a write-before-zero. This flaw allows an attacker to control 4 bytes of memory written, enabling precise memory corruption.

CVE-2025-10457 is a medium severity vulnerability in Zephyr RTOS versions prior to 4.3.0. The issue arises because the BLE connection response handler does not verify if a response is expected and relies solely on identifier matching. This improper security check can lead to incorrect handling of BLE connection responses, potentially causing denial of service.

CVE-2025-2962 is a denial-of-service vulnerability in the Zephyr RTOS DNS implementation caused by an infinite loop with an unreachable exit condition. This flaw can cause the affected system to become unresponsive due to resource exhaustion. It has a high severity score of 8.2 and impacts availability only, without affecting confidentiality or integrity.

CVE-2025-1675 is a high severity vulnerability in the Zephyr RTOS affecting versions before 3.7.2 and from 4.0.0 up to but not including 4.1.0. It is caused by an out-of-bounds read in the dns_copy_qname function due to memcpy being called on an untrusted source without verifying the source buffer size. This flaw can lead to denial of service through memory corruption. No known exploits have been reported in the wild. Patch status is not confirmed due to lack of vendor advisory information.

CVE-2025-1674 is a high-severity vulnerability in the Zephyr real-time operating system caused by insufficient input validation that leads to out-of-bounds reads. This flaw can be triggered by malicious or malformed packets and may cause denial of service through application crashes. It affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.1.0. No known exploits have been reported in the wild. The CVSS score of 8.2 reflects a significant risk mainly due to potential availability impact.

CVE-2025-1673 is an out-of-bounds read vulnerability in the DNS handling code of the Zephyr RTOS. It can be triggered by a malicious or malformed DNS packet without a payload, potentially causing a crash or incorrect computation. This leads to denial of service conditions. The vulnerability affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.1.0. The severity is high with a CVSS score of 8.2.