PT-2023-5664 · Zephyr · Zephyr

Alxelax + 1 · Published 2023-09-25 · Updated 2023-09-26 · CVE-2023-4258

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The issue is related to errors in the representation of given functions in the Bluetooth protocol implementation of the Zephyr real-time operating system. It may allow a remote attacker to gain unauthorized access to protected information. In the Bluetooth mesh implementation, if a provisionee has a public key sent out-of-band (OOB), it can be sent back during provisioning and will be accepted by the provisionee.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-684

Related Identifiers

BDU:2023-06331

CVE-2023-4258

GHSA-M34C-CP63-RWH7

Affected Products

Zephyr

References · 10

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-4258 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4258 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06331 · Security Note
• https://twitter.com/CVEnew/status/1706426542740435072 · Twitter Post
• https://t.me/cvenotify/58582 · Telegram Post
• https://twitter.com/cracbot/status/1706549270055473493 · Twitter Post
• https://vuldb.com/ru/?id.240349 · Note
• https://t.me/cibsecurity/71031 · Telegram Post
• https://t.me/cvenotify/58606 · Telegram Post