CVE-2021-3436

Name of the Vulnerable Software and Affected Versions: Zephyr versions 1.14.2 and later Zephyr versions 2.4.0 and later Zephyr versions 2.5.0 and later

Description: The issue allows overwriting an existing bond during the keys distribution phase when the identity address of the bond is known. This is due to the use of multiple resources with duplicate identifiers.

Recommendations: For Zephyr versions 1.14.2 and later, consider disabling the bond overwrite functionality until a patch is available. For Zephyr versions 2.4.0 and later, restrict access to the keys distribution phase to minimize the risk of exploitation. For Zephyr versions 2.5.0 and later, avoid using the identity address of the bond in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.