Zephyrproject Zephyr

Incorrect Error Handling in Bluetooth HCI core

Remote Denial of Service in LwM2M do_write_op_tlv

Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image

User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier

DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled

Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)

Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)

Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback

net: TLS 1.2 connections allowed on TLS 1.3 sockets

Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure

Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)

Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`

NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume

NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers

Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control

Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.

Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer

L2CAP: Information leakage in le_ecred_conn_req()

BT: Invalid channel map in CONNECT_IND results to Deadlock

Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)

Security problem with settings and littlefs

Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic