CVEs (163)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Unchecked length coming from user input in settings shell |
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. |
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device. |
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver |
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c |
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver |
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal except...Show more |
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem |
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. |
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. |
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. |
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
|
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blo...Show more |
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. |
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, lead...Show more |
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer,...Show more |
A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible. |