Executive brief
A vulnerability in the Zephyr operating system's Precision Time Protocol (PTP) subsystem could allow an attacker on the same local network to crash the system. By sending specially crafted timing messages, an attacker can trigger an internal calculation error that leads to a system-wide failure or resource exhaustion. This disrupts the availability of devices using Zephyr for synchronized timekeeping in industrial or embedded environments.
Technical details
A bitwise shift vulnerability (CWE-1335) exists in the Zephyr PTP subsystem due to insufficient validation of the log_announce_interval value. An attacker can send a PTP_MSG_MANAGEMENT message to set an unvalidated negative interval in the port's data set. When a subsequent PTP_MSG_ANNOUNCE message is processed, the function port_timer_set_timeout_random performs a right-shift operation on a 64-bit integer using the attacker-controlled value. If the value is sufficiently negative (e.g., -127), the shift amount exceeds the 64-bit width, triggering undefined behavior. This can result in an illegal instruction trap (crash) or a zero-timeout value leading to resource starvation loops. The attack requires adjacent network access but no authentication.
Affected products
- Zephyr Project Zephyr RTOS <= 4.3
Timeline
- 2026-05-18: other: Embargo date
- 2026-05-22: disclosed: Initial publication date
- 2026-05-22: advisory: GitHub Security Advisory published