PT-2021-20071 · Zephyr · Zephyr

Ceolin · Published 2021-10-05 · Updated 2022-10-25 · CVE-2021-3319

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr versions >= v2.4.0

Description The issue is related to incorrect 802154 frame validation for omitted source and destination addresses, leading to a NULL Pointer Dereference (CWE-476) and an attempt to access a child of a non-structure pointer (CWE-588).

Recommendations For Zephyr versions >= v2.4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-588

CWE-476

Related Identifiers

CVE-2021-3319

GHSA-94JG-2P6Q-5364

Affected Products

Zephyr

References · 5

• 🔥 http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94jg-2p6q-5364 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3319 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3319 · Vendor Advisory
• https://t.me/cvenotify/21960 · Telegram Post
• https://t.me/cibsecurity/30010 · Telegram Post