PT-2023-5664 · Zephyr · Zephyr

Alxelax + 1 · Publicado 2023-09-25 · Atualizado 2023-09-26 · CVE-2023-4258

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The issue is related to errors in the representation of given functions in the Bluetooth protocol implementation of the Zephyr real-time operating system. It may allow a remote attacker to gain unauthorized access to protected information. In the Bluetooth mesh implementation, if a provisionee has a public key sent out-of-band (OOB), it can be sent back during provisioning and will be accepted by the provisionee.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-684

Identificadores relacionados

BDU:2023-06331

CVE-2023-4258

GHSA-M34C-CP63-RWH7

Produtos afetados

Zephyr

Referências · 10

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-4258 · Nota de Segurança
• https://twitter.com/CVEnew/status/1706426542740435072 · Publicação no Twitter
• https://t.me/cvenotify/58582 · Publicação no Telegram
• https://twitter.com/cracbot/status/1706549270055473493 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4258 · Aviso do Fabricante
• https://vuldb.com/ru/?id.240349 · Nota
• https://bdu.fstec.ru/vul/2023-06331 · Nota de Segurança
• https://t.me/cibsecurity/71031 · Publicação no Telegram
• https://t.me/cvenotify/58606 · Publicação no Telegram