Executive brief
Zephyr RTOS includes a gPTP (generalized Precision Time Protocol) networking module used for time synchronization on industrial and automotive networks. An attacker on the same network link can send a specially crafted Ethernet frame that triggers an out-of-bounds memory read, potentially disclosing stale data from internal buffers. This issue requires physical or virtual access to the local network segment and affects only systems with gPTP enabled.
Technical details
The vulnerability is a classic buffer over-read in gptp_handle_msg() within the gPTP subsystem. The code retrieves a gPTP header via GPTP_HDR() without first validating that the received Ethernet frame contains at least 34 bytes of payload (the minimum gPTP header size). The header accessor is deliberately lenient and returns a pointer to the start of the buffer without bounds checking, delegating validation to callers. The subsequent length validation via GPTP_VALID_LEN() fails to catch truncated frames because its check (len > 60) is never true for standard gPTP messages once the Ethernet header is removed. The short packet is then retained and parsed by downstream state machines, which read tens of additional bytes and can copy data (port identifiers, priority vectors) into transmitted frames. Under fixed-size buffer allocation (default), accesses remain within the allocated fragment but disclose stale recycled buffer contents; under variable-size allocation, genuine out-of-bounds reads occur. Attack vector is unauthenticated; a peer on the same link sends an 0x88F7 ethertype frame to the PTP multicast address, with sub-minimum frame lengths deliverable via non-standard TAP drivers or accepting undersized frames.
Affected products
- Zephyr Project Zephyr RTOS <unknown
Timeline
- 2026-09-18: disclosed
- other: CVE-2026-16512 assigned