Executive brief
LoRaWAN is a wireless protocol used for low-power IoT device connectivity and firmware updates. A defect in the fragmented data block transport service allows an attacker with network access to send a specially crafted fragment message that corrupts the firmware update decoder state, preventing legitimate devices from receiving over-the-air (FUOTA) firmware updates and causing a denial of service on update sessions.
Technical details
The vulnerability is an integer underflow (CWE-787) in subsys/lorawan/services/frag_transport.c. The frag_transport_package_callback() function reads a fragment counter directly from an incoming LoRaWAN DATA_FRAGMENT downlink message without validating that it is non-zero, then passes it to the decoder which derives array indices by subtracting 1. A frag_counter value of 0 causes the subtraction to underflow to -1, resulting in an out-of-bounds write of a uint16_t zero into memory adjacent to the decoder's internal state (the MatrixM2B recovery matrix). Exploitation requires an active fragmentation session and authenticated LoRaWAN downlink messages (MAC session keys or a compromised network/FUOTA server), but no user interaction. The Semtech/LoRaMAC-node decoder is affected; the in-tree low-memory decoder rejects out-of-range accesses via bounds checks. Impact is limited to decoder state corruption and denial of the FUOTA session; the flash write path that might write to an attacker-controlled offset is rejected by flash area bounds checks. A fix adds a transport-layer validation that rejects frag_counter == 0.
Affected products
- Zephyr Zephyr RTOS unspecified
Timeline
- 2026-08-14: disclosed
- 2026-08-14: advisory