Executive brief
Zephyr RTOS's LoRaWAN clock synchronization service contains a buffer over-read vulnerability in its handling of time-correction commands from a network or application server. An attacker with access to session keys or control of the server could craft a malicious time-sync message to read past the buffer boundary and potentially corrupt the device's internal clock offset, affecting time accuracy for time-sensitive operations.
Technical details
The vulnerability is a buffer over-read in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c) within the LoRaWAN application layer. When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command, the handler reads 5 bytes (4-byte time correction via sys_get_le32() plus 1-byte token) without verifying that 5 bytes remain in the receive buffer. The attack requires a LoRaWAN MAC frame on the clock-sync port that passes integrity checks and FRMPayload decryption, limiting the attacker to a malicious network/application server or party holding session keys. The over-read is bounded by a fixed 255-byte static buffer backing store and does not leak data or cause a crash; the sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's clock offset (ctx.time_offset), a minor integrity impact. The fix adds an explicit length check that rejects too-short AppTimeAns frames.
Affected products
- Zephyr Project Zephyr RTOS unknown
Timeline
- 2026-08-26: disclosed: CVE-2026-13479 published