Executive brief
Zephyr RTOS contains a flaw in its gPTP (Precision Time Protocol) implementation that processes Ethernet time-synchronization frames. An attacker on the same network segment can craft a malicious Announce frame that causes the network stack to read memory beyond the received packet boundary, potentially crashing the networking thread and causing a denial of service. The vulnerability only affects specialized industrial/automotive deployments using gPTP for time-critical applications.
Technical details
The vulnerability exists in gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c, which processes the Path Trace TLV field of IEEE 802.1AS gPTP Announce messages. The loop that walks path trace entries uses the attacker-controlled steps_removed field (up to 254) as the iteration bound, but fails to validate it against the actual tlv.len field that indicates how many identities are present. Since the path_sequence is a flexible array member in the received packet buffer, the memcmp() call can read up to 2 KB of memory beyond the frame boundary. The vulnerability requires network adjacency (Layer 2) to exploit, as gPTP frames use link-local multicast addressing. The fix validates that steps_removed + 1 does not exceed the computed entry count (tlv.len / GPTP_CLOCK_ID_LEN), preventing out-of-bounds reads.
Affected products
- Zephyr Project Zephyr RTOS versions with CONFIG_NET_GPTP enabled
Timeline
- 2026-09-18: disclosed