Executive brief
A vulnerability exists in the Zephyr operating system's networking component used for CAN bus communication. A local application can provide a specially crafted, shortened data packet that causes the system to read memory outside of the intended area. This can lead to system crashes (denial of service) or the accidental transmission of sensitive internal memory over the network.
Technical details
The SocketCAN implementation in Zephyr RTOS validates the length of user-provided buffers containing 'socketcan_frame' objects using only 'NET_ASSERT' statements in 'zcan_sendto_ctx()'. In production builds where assertions are disabled, the 'socketcan_to_can_frame()' function dereferences fields beyond the end of the buffer if a truncated frame is provided via a 'sendto' syscall. This out-of-bounds read allows a local attacker to cause a denial-of-service (DoS) crash. Furthermore, because the parsed frame contents are subsequently transmitted on the network, an attacker may be able to exfiltrate sensitive data from adjacent memory. The vulnerability is addressed by replacing the assertion with an explicit runtime check.
Affected products
- Zephyr Project Zephyr RTOS <= 4.3
Timeline
- 2026-05-18: other: Embargo date
- 2026-05-30: advisory: GitHub advisory published
- 2026-05-30: disclosed: NVD publication date