Executive brief
Zephyr RTOS includes an IEEE 1588 Precision Time Protocol (PTP) network subsystem used for time synchronization in networked devices. A flaw in the PTP management-message parser fails to validate message length before reading timestamp data, allowing an attacker on the local network to send a malicious PTP message that causes the device to read beyond allocated buffer boundaries. While the out-of-bounds access stays within the device's allocated memory and does not cause a crash, it can leak adjacent memory contents and corrupt the device's internal time synchronization state.
Technical details
The vulnerability is a missing length check (CWE-125: out-of-bounds read) in the tlv_mgmt_post_recv() function in subsys/net/lib/ptp/tlv.c. When processing PTP_MGMT_TIME management TLV messages, the code casts incoming data to a 10-byte ptp_timestamp struct and reads/writes it without first validating that the TLV data field contains at least 10 bytes. The upstream validation only checks tlv->length > 2, allowing an attacker to craft a PTP_MSG_MANAGEMENT message with a short PTP_MGMT_TIME TLV (as small as 2 bytes) to trigger an 8-byte out-of-bounds read and write. The access is adjacent in-object memory within the same ptp_msg allocation, resulting in limited information exposure and corruption of the parsed management TIME value rather than heap corruption or crash. The fix adds a length validation before the cast, matching the pattern used for other management IDs. Reachability requires CONFIG_PTP enabled and an attacker on the local PTP network segment (adjacent attack vector).
Affected products
- Zephyr Project Zephyr RTOS <UNKNOWN>
Timeline
- 2026-08-26: disclosed