Zephyrproject
zephyrproject
189 CVEs • 1 product
Products (1)
Click to collapseToggle
Products (1)
Click to collapse
CVEs (189)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blo...Show more |
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. |
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, lead...Show more |
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer,...Show more |
A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible. |
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack |
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. |
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. |
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. |
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. |
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily. |
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. |
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this...Show more |
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. |
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rq...Show more |
Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6r...Show more |
Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more information, see https://github.com/zephyrproject-rtos/zephyr/sec...Show more |