PT-2022-10341 · Zephyr · Zephyr

Bronallo-Bd + 1 · Published 2022-06-28 · Updated 2022-07-08 · CVE-2021-3435

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr versions >= v2.4.0

Description The issue is related to information leakage in the le ecred conn req() function, which is caused by the use of an uninitialized resource. This is classified as a CWE-908 vulnerability.

Recommendations For Zephyr versions >= v2.4.0, consider disabling the le ecred conn req() function until a patch is available to prevent potential information leakage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-3435

GHSA-XHG3-GVJ6-4RQH

Affected Products

Zephyr

References · 5

• http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3435 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3435 · Vendor Advisory
• https://t.me/cvenotify/32319 · Telegram Post
• https://t.me/cibsecurity/45337 · Telegram Post