Tim Pambor

**Name of the Vulnerable Software and Affected Versions** Zephyr networking versions 4.2.0 through 4.4.0 **Description** A use-after-free issue exists in the ICMPv6 implementation where the network interface is read from a `net pkt` after the packet has been processed by `net try send data()`. Specifically, in the `icmpv6 handle echo request()` and `net icmpv6 send error()` functions, post-send statistics updates call `net pkt iface()` on a packet that may have already been unreferenced and freed. When `CONFIG NET STATISTICS PER INTERFACE` is enabled, this results in a write operation through a stale pointer. An unauthenticated remote attacker can trigger this by sending an ICMPv6 Echo Request or an IPv6 packet that generates an ICMPv6 error, potentially leading to memory corruption or a system crash causing denial of service. **Recommendations** Update Zephyr networking versions 4.2.0 through 4.4.0 to a version where the interface pointer is cached before sending and used for all statistics updates.