Known Vulnerabilities
CVE-2024-11263
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVE-2024-6259
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
CVE-2024-6137
BT: Classic: SDP OOB access in get_att_search_list
CVE-2024-6135
BT:Classic: Multiple missing buf length checks
CVE-2024-5931
BT: Unchecked user input in bap_broadcast_assistant
CVE-2024-6258
BT: Missing length checks of net_buf in rfcomm_handle_data
CVE-2024-3332
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
CVE-2024-1638
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
CVE-2023-4257
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
CVE-2023-4263
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
CVE-2023-4260
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
CVE-2023-4264
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.