CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3332 – bt: host/smp: DoS caused by null pointer dereference
https://notcve.org/view.php?id=CVE-2024-3332
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmr9-xw2v-5vf4 • CWE-476: NULL Pointer Dereference •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3077 – Bluetooth: integer underflow in gatt_find_info_rsp
https://notcve.org/view.php?id=CVE-2024-3077
An malicious BLE device can crash BLE victim device by sending malformed gatt packet Un dispositivo BLE malicioso puede bloquear el dispositivo víctima de BLE al enviar un paquete gatt con formato incorrecto • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gmfv-4vfh-2mh8 • CWE-126: Buffer Over-read CWE-190: Integer Overflow or Wraparound •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7060 – Missing Security Control in Zephyr OS IP Packet Handling
https://notcve.org/view.php?id=CVE-2023-7060
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address. El manejo de paquetes IP de Zephyr OS no descarta adecuadamente los paquetes IP que llegan a una interfaz externa con una dirección de origen igual a 127.0.01 o la dirección de destino. • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6881 – fs: fuse: buffer overflow vulnerability in the Zephyr FS
https://notcve.org/view.php?id=CVE-2023-6881
Possible buffer overflow in is_mount_point Posible desbordamiento de búfer en is_mount_point • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mh67-4h3q-p437 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1638 – Bluetooth characteristic LESC security requirement not enforced without additional flags
https://notcve.org/view.php?id=CVE-2024-1638
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read. La documentación especifica que BT_GATT_PERM_READ_LESC y BT_GATT_PERM_WRITE_LESC definen para una característica de Bluetooth: Atributo permiso de lectura/escritura con cifrado LE Secure Connection. Si está configurado, requiere que se utilice LE Secure Connections para acceso de lectura/escritura; sin embargo, esto solo es cierto cuando se combina con otros permisos, a saber, BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (para lectura) o BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (para escritura), si estos permisos adicionales no están configurados (incluso en el modo de solo conexiones seguras), entonces la pila no realiza ninguna verificación de permisos sobre estas características y se pueden escribir/leer libremente. • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p6f3-f63q-5mc2 • CWE-20: Improper Input Validation •