Vulnerabilities

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers.

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places.

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack.

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges.

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions.

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel.

The arm platform-specific code uses a signed integer comparison when validating system call numbers.

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr ke…

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS.

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions.

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size.