Zhuxilei1204

**Name of the Vulnerable Software and Affected Versions** loramac-node (affected versions not specified) **Description** The LoRaWAN TS004 Fragmented Data Block Transport handler `frag transport package callback()` in `subsys/lorawan/services/frag transport.c` parses downlink command bytes without validating if sufficient payload bytes remain before each access. The handler casts `rx buf + rx pos` to a 10-byte `frag transport setup req` struct or passes `&rx buf[rx pos]` to the fragment decoder, which reads `ctx.frag size` bytes without checking the remaining length. Since `ctx.frag size` is attacker-controlled via a `FRAG SESSION SETUP` command, an attacker possessing the device session keys can use mismatched-index `DATA FRAGMENT` filler commands to force the decoder to read beyond the end of the `MacCtx.RxPayload` buffer. This results in a bounded out-of-bounds read, potentially copying adjacent static memory into decoder buffers and the FUOTA (Firmware Update Over-The-Air) flash image. The issue is limited to parties with session keys, and because the over-read data is not returned to the sender, there is no direct disclosure channel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zephyr (affected versions not specified) **Description** A malformed Bluetooth Classic Service Discovery Protocol (SDP) attribute can trigger a reachable assertion in the SDP parser. In the file `subsys/bluetooth/host/classic/sdp.c`, the function `bt sdp parse attribute()` accepts an input buffer containing a 1-byte attribute type and 2-byte attribute id, but fails to verify the presence of a byte for the value type before attempting to pull it. A truncated 3-byte attribute can cause `net buf simple pull()` to be called with insufficient remaining length. In builds with assertions enabled, this triggers a kernel panic, resulting in a denial of service. In builds where assertions are disabled, this may lead to an out-of-bounds read and undefined behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.