Zephyrproject Zephyr

Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim

Buffer overflow in Zephyr USB

Bluetooth: integer underflow in gatt_find_info_rsp

BT: Missing length checks of net_buf in rfcomm_handle_data

Buffer Overreads in Bluetooth HCI

crypto: ATAES132A response length allows stack buffer overflow

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.

BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known

zephyr: out-of-bound read in utf8_trunc

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr

Zephyr Bluetooth DLE duplicate requests vulnerability

BT: Unchecked user input in bap_broadcast_assistant

bt: host/smp: DoS caused by null pointer dereference

Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

Zephyr Bluetooth unchecked packet data results in denial of service

Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it

Bluetooth: ots: missing buffer length check

Bluetooth: ASCS Unchecked tailroom of the response buffer

ptp: Potential Denial of Service via PTP Interval Shift

Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling

PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

Possible to retrieve uncrypted firmware image

Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

net: ip/tcp: Null pointer dereference can be triggered by a race condition

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init

NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion

Use-after-free / double-free of the root USB device in the experimental USB host stack

stm32: usb: Infinite while loop in Interrupt Handler

net: Stack Overflow with Ping (to own IP Address) via Shell

Improper Handling of Insufficient Permissions or Privileges in zephyr

UpdateHub Module Explicitly Disables TLS Verification