PT-2026-49711 · Zephyr · Zephyr
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Zephyr networking versions 4.2.0 through 4.4.0
Description
A use-after-free issue exists in the ICMPv6 implementation where the network interface is read from a
net pkt after the packet has been processed by net try send data(). Specifically, in the icmpv6 handle echo request() and net icmpv6 send error() functions, post-send statistics updates call net pkt iface() on a packet that may have already been unreferenced and freed. When CONFIG NET STATISTICS PER INTERFACE is enabled, this results in a write operation through a stale pointer. An unauthenticated remote attacker can trigger this by sending an ICMPv6 Echo Request or an IPv6 packet that generates an ICMPv6 error, potentially leading to memory corruption or a system crash causing denial of service.Recommendations
Update Zephyr networking versions 4.2.0 through 4.4.0 to a version where the interface pointer is cached before sending and used for all statistics updates.
Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zephyr