Xuedugu

**Name of the Vulnerable Software and Affected Versions** OCPP 1.6 client (affected versions not specified) **Description** A stack buffer overflow exists in the `parse getconfig msg()` function within the `subsys/net/lib/ocpp/ocpp j.c` file. The issue occurs when the handler processes a GetConfiguration request from a central system and uses an unbounded `strcpy()` to copy an attacker-controlled JSON `key` string into a fixed 50-byte stack buffer `skey[CISTR50]` located in `subsys/net/lib/ocpp/ocpp.c`. Because the `key` value length is only limited by the receive buffer size (`CONFIG OCPP RECV BUFFER SIZE`), an attacker controlling the central system endpoint or performing a man-in-the-middle attack on an unencrypted connection can send a request with a `key` field exceeding 50 bytes. This can lead to a stack smash on the `ocpp wsreader()` reader thread, resulting in a denial of service or potentially remote code execution. **Recommendations** Replace the `strcpy()` function with a bounded `strncpy(key, payload.key[0], CISTR50 - 1)` and ensure explicit NUL termination.

**Name of the Vulnerable Software and Affected Versions** Zephyr version 4.3.0 Zephyr version 4.4.0 **Description** The DNS resolver in `subsys/net/lib/dns` fails to properly validate the `rdlength` of resource records in DNS responses within the `dns unpack answer()` function. This allows the acceptance of an attacker-declared `rdlength` that may extend beyond the end of the received datagram. Subsequently, the TXT and SRV consumers in `dns validate record()` (located in `resolve.c`) use `memcpy` to read up to `rdlength` bytes from the receive buffer without performing a bounds check against the actual packet size. A malicious DNS server, an on-path attacker, or a LAN node (if mDNS/LLMNR is enabled) can craft truncated TXT or SRV responses to trigger an out-of-bounds read of adjacent receive-pool memory. This results in an information leak where stale bytes from prior DNS packets or uninitialized memory are returned to the application. In certain configurations, this may also cause a system fault leading to a denial of service. **Recommendations** Update Zephyr version 4.3.0 to a version where the `dns unpack answer()` function rejects records whose declared rdata extends past `dns msg->msg size`. Update Zephyr version 4.4.0 to a version where the `dns unpack answer()` function rejects records whose declared rdata extends past `dns msg->msg size`.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions 3.0.0 through 3.x **Description** An out-of-bounds read exists in the Bluetooth controller ISO Adaptation Layer within the `subsys/bluetooth/controller/ll sw/isoal.c` file. The issue occurs because the `isoal check seg header()` function fails to properly validate the length field of a framed ISO PDU start segment. According to the Bluetooth specification, a start segment must have a segment-header length of at least 3 bytes to accommodate the `time offset`. When a length between 0 and 2 is provided, the `isoal rx framed consume()` function performs a subtraction that results in an integer underflow, creating an oversized length value. This value is then passed to `isoal rx append to sdu()`, which copies up to 255 bytes of controller memory beyond the received PDU into an HCI ISO data packet. A remote attacker can trigger this via CIS or BIS-sync HCI data paths or the vendor data path, leading to information disclosure to the host or a denial of service. **Recommendations** Update Zephyr to a version where the `isoal check seg header()` function rejects start segments with a length less than 3 and a guard is implemented before the subtraction in `isoal rx framed consume()`.

**Name of the Vulnerable Software and Affected Versions** Zephyr (affected versions not specified) **Description** The ext2 directory-entry parser fails to fully validate the on-disk directory entry structure before copying the entry name and advancing the traversal state. Specifically, in the `ext2 fetch direntry()` function, the system checks if `de name len` is less than or equal to `EXT2 MAX FILE NAME` but does not validate the structural relationship between `de rec len`, `de name len`, and the directory block boundary. This includes failing to verify that `de rec len` is non-zero, at least the size of the entry header, and that the record fits within the block. Functions such as `find dir entry()` and `ext2 get direntry()` then use the unvalidated `de rec len` to advance traversal. A crafted ext2 image can trigger an out-of-bounds read from the directory block buffer via an oversized name copy or cause an infinite loop if `de rec len` is zero. This issue occurs during directory traversal paths, including pathname lookup, stat, open, unlink, rename, and readdir, potentially leading to denial of service and out-of-bounds reads when mounting untrusted media. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr versions 1.7 through 4.4.0 **Description** The Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser in `subsys/bluetooth/host/classic/hfp hf.c` contains an out-of-bounds write. During Service Level Connection setup, the Hands-Free (HF) unit sends `AT+CIND=?` and parses the Attendant Gateway (AG) response in the `cind handle()` function, which assigns a per-entry counter index and calls `cind handle values()` for each list element. The `cind handle values()` function writes to `hf-ind table[index]` without verifying that the `index` is within the 20-element `int8 t ind table[]` array of `struct bt hfp hf`. Since the parser does not limit the number of `+CIND:` list entries, a remote Attendant Gateway can send a response with more than 20 entries to drive the `index` arbitrarily large. This allows writing values past the array into adjacent struct fields, such as feature masks, SDP/version state, the `calls[]` array, and work/atomic bookkeeping, potentially extending beyond the static connection pool slot. This results in memory corruption and denial of service of the Bluetooth host, triggered by a single malformed AT response without user interaction. **Recommendations** Update Zephyr to a version later than 4.4.0. As a temporary workaround, disable `CONFIG BT HFP HF` to mitigate the risk of exploitation.