Executive brief
Zephyr is a real-time operating system used in IoT and embedded devices, particularly in wireless mesh networks. A flaw in its 6LoWPAN header compression code allows an attacker on an adjacent radio network to craft malicious wireless frames that trigger an out-of-bounds memory read on receiving devices, causing denial-of-service or potential information disclosure without requiring authentication or user interaction.
Technical details
The vulnerability is an out-of-bounds read in the get_ihpc_inlined_size() function within subsys/net/ip/6lo.c. The function looks up a destination inline size using a 4-bit index derived from IPHC dispatch bits (M, DAC, DAM) into a lookup table (da_inline_size_table) that contains only 13 entries. Index values 13, 14, and 15 are not bounds-checked, allowing the function to read past the table. An unauthenticated attacker on the adjacent 802.15.4 radio link can craft a 6LoWPAN frame with a reserved IPHC destination-addressing mode to trigger the out-of-bounds read every time the frame is received. The out-of-bounds value is then used to dereference packet buffer data and compute a size_t that may underflow, leading to further memory corruption. The fix adds bounds checking to reject destination indices beyond the valid range.
Affected products
- Zephyr Zephyr OS
Timeline
- 2026-08-17: disclosed