Executive brief
Zephyr is an open-source operating system designed for resource-constrained embedded devices. A flaw in how it handles secure network connections (TLS) could allow an attacker to crash a device or potentially take control of it. This occurs when the system fails to properly check the size of network address data, leading to memory corruption that disrupts normal operations or exposes sensitive data.
Technical details
An out-of-bounds (OOB) write and read vulnerability exists in `subsys/net/lib/sockets/sockets_tls.c` within the Zephyr RTOS network subsystem. The functions `tls_session_store()` and `tls_session_restore()` utilize `memcpy()` to copy caller-supplied address data into a fixed-size `struct net_sockaddr` buffer without validating the `addrlen` parameter. Because `net_sockaddr` is an opaque type, an application can pass an `addrlen` significantly larger than the destination buffer (e.g., 128 bytes into a 24-byte stack buffer). This results in a stack-based buffer overflow. Exploitation requires the TLS session cache to be enabled and can be triggered via the `connect()` system call, potentially leading to arbitrary code execution or a system crash. Patches have been developed for versions 3.7, 4.2, 4.3, and the main branch.
Affected products
- Zephyr Project Zephyr RTOS <= 4.3
Timeline
- 2026-06-01: other: Embargo date
- 2026-06-04: advisory: GitHub advisory and NVD publication