PT-2023-7237 · Zephyr · Zephyr

0Xdea · Published 2023-10-06 · Updated 2023-12-22 · CVE-2023-3725

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The issue is related to a potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. This vulnerability may allow a remote attacker to execute arbitrary code. The vulnerability is associated with the file subsys/canbus/isotp/isotp.c and is related to a stack-based buffer overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-120

CWE-787

Related Identifiers

BDU:2023-08265

CVE-2023-3725

GHSA-2G3M-P6C7-8RR3

Affected Products

Zephyr

References · 11

• 🔥 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2g3m-p6c7-8rr3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3725 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08265 · Security Note
• https://twitter.com/CVEnew/status/1710391302628503916 · Twitter Post
• https://t.me/cvenotify/64957 · Telegram Post
• https://docs.zephyrproject.org/3.5.0/releases/release-notes-3.5.html · Note
• http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html · Note
• https://t.me/cibsecurity/71767 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/07/1 · Note
• http://seclists.org/fulldisclosure/2023/Nov/1 · Note