Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in its time-synchronization client (SNTP) could allow a remote attacker to crash a device by interfering with network timing responses. This could lead to a denial-of-service state or unpredictable behavior in connected industrial or consumer hardware.
Technical details
A use-after-free vulnerability exists in the Zephyr SNTP client (subsys/net/lib/sntp/sntp.c) due to a lack of synchronization between the calling thread and the socket-service poll thread. When 'sntp_close_async' is invoked (typically during a timeout), it closes the UDP socket file descriptor and frees the underlying 'net_context' while the socket service thread may still be polling it. Because 'net_context' objects are allocated from a fixed pool and reused, this leads to object confusion or a kernel crash. An off-path attacker can trigger this race by dropping or delaying SNTP responses. The issue is resolved by deferring the socket close operation to the socket service thread itself.
Affected products
- zephyrproject zephyr 4.2.0 to 4.4.0
Timeline
- 2026-06-30: advisory: GHSA-34wr-cg29-c4mw published
- 2026-06-30: disclosed
- 2026-05-01: patched: Fix commit ef47bdf authored