Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A flaw in its networking component allows a user to crash the device by commanding it to 'ping' its own IP address. This causes the system to enter an infinite loop of internal processing that exhausts available memory, leading to a system failure and service outage.
Technical details
A stack overflow vulnerability exists in the Zephyr RTOS network stack due to uncontrolled recursion when processing local ICMP traffic. When the 'net ping' shell command is used to target the device's own IPv4 address, the network stack recognizes the destination as local and processes both the echo request and the resulting echo reply inline. This causes the system to recursively re-enter the input path on the same system work-queue stack without returning. Because these frames are nested, they eventually exceed the 'CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE' (typically 1024 bytes), triggering a fatal stack overflow and system halt. The attack requires local shell access to the device.
Affected products
- Zephyr Project Zephyr <= 4.3.0
Timeline
- 2026-05-12: advisory: Vendor advisory and CVE published