Executive brief
Zephyr is an open-source real-time operating system (RTOS) used to power embedded devices and IoT applications. A buffer overflow vulnerability in its TLS socket handling can allow an unprivileged user or thread to crash the kernel or execute arbitrary code by supplying a small buffer when querying the peer's DTLS connection ID on an established encrypted connection.
Technical details
The vulnerability is a heap buffer overflow in the tls_opt_dtls_peer_connection_id_value_get() function in subsys/net/lib/sockets/sockets_tls.c. When handling the getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) syscall, the code passes a caller-supplied buffer directly to mbedtls_ssl_get_peer_cid() without validating that the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes. The underlying mbedtls function unconditionally writes up to 31 bytes past a smaller buffer. In CONFIG_USERSPACE builds, the syscall verifier bounce-buffers the user's optval into a kernel heap allocation of exactly optlen bytes, making this exploitable by any unprivileged user thread with an established DTLS session where Connection ID negotiation is enabled. The vulnerability was introduced in v3.5.0 when the TLS_DTLS_CID option was added and requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID to be enabled. A patch validates that optlen is at least the required size and rejects smaller buffers with -EINVAL.
Affected products
- Zephyr Project Zephyr RTOS v3.5.0 and later
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Patch committed to main branch (commit aa317825a55a401315e8e17f620c70c02e8f176d)