CVE-2021-3320: Type Confusion in 802154 ACK Frames Handling

Q: What is CVE-2021-3320?

CVE-2021-3320 is a vulnerability in Zephyr versions >= v2.4.0 that allows for a NULL pointer dereference, leading to a type confusion in 802154 ACK frames handling.

Published May 24, 2021

Updated

Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-27r3-rxch-2hm7

Affected Software

1 affected component

zephyrproject zephyr>=2.0.0<=2.4.0

Event History

May 24, 2021

CVE Published

via MITRE·09:40 PM

Data Sourced

via MITRE·09:40 PM

DescriptionSeverityWeakness

May 25, 2021

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-3320?

CVE-2021-3320 is a vulnerability in Zephyr versions >= v2.4.0 that allows for a NULL pointer dereference, leading to a type confusion in 802154 ACK frames handling.

What is the severity of CVE-2021-3320?

The severity of CVE-2021-3320 is high, with a severity value of 7.5.

How does CVE-2021-3320 affect Zephyr?

CVE-2021-3320 affects Zephyr versions >= v2.4.0, potentially leading to a NULL pointer dereference and type confusion in 802154 ACK frames handling.

How can I fix CVE-2021-3320?

To fix CVE-2021-3320, it is recommended to update Zephyr to a version that is not affected by this vulnerability.

What is CWE-476?

CWE-476 is a Common Weakness Enumeration category that refers to NULL Pointer Dereference vulnerabilities.