Filtered by vendor Zephyrproject Subscriptions
Total 104 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-3725 1 Zephyrproject 1 Zephyr 2025-02-13 7.6 High
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
CVE-2023-0779 1 Zephyrproject 1 Zephyr 2025-02-13 6.7 Medium
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
CVE-2024-4785 1 Zephyrproject 1 Zephyr 2025-02-03 7.6 High
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
CVE-2024-8798 1 Zephyrproject 1 Zephyr 2025-02-03 7.5 High
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVE-2024-11263 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-02-03 9.4 Critical
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVE-2024-3332 1 Zephyrproject 1 Zephyr 2025-02-03 6.5 Medium
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
CVE-2024-3077 1 Zephyrproject 1 Zephyr 2025-01-23 6.8 Medium
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
CVE-2023-6881 1 Zephyrproject 1 Zephyr 2025-01-23 7.3 High
Possible buffer overflow in is_mount_point
CVE-2023-6249 1 Zephyrproject 1 Zephyr 2025-01-23 8 High
Signed to unsigned conversion esp32_ipm_send
CVE-2023-5779 1 Zephyrproject 1 Zephyr 2025-01-22 4.4 Medium
can: out of bounds in remove_rx_filter function
CVE-2023-6749 1 Zephyrproject 1 Zephyr 2025-01-22 8 High
Unchecked length coming from user input in settings shell
CVE-2023-5563 1 Zephyrproject 1 Zephyr 2024-11-21 7.1 High
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
CVE-2023-5055 1 Zephyrproject 1 Zephyr 2024-11-21 8.3 High
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
CVE-2023-4424 1 Zephyrproject 1 Zephyr 2024-11-21 8.3 High
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
CVE-2023-4258 1 Zephyrproject 1 Zephyr 2024-11-21 8.6 High
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
CVE-2023-2234 1 Zephyrproject 1 Zephyr 2024-11-21 6.8 Medium
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
CVE-2023-1902 1 Zephyrproject 1 Zephyr 2024-11-21 5.9 Medium
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
CVE-2023-1901 1 Zephyrproject 1 Zephyr 2024-11-21 5.9 Medium
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
CVE-2023-0359 1 Zephyrproject 1 Zephyr 2024-11-21 5.9 Medium
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
CVE-2022-2741 1 Zephyrproject 1 Zephyr 2024-11-21 8.2 High
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).