CVE-2026-11809: UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in zimplupdatehubprobe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadatacopy) is allocated with kmalloc (unzeroed) and filled with memcpy(metadatacopy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap.

When the first jsonobjparse() over the array descriptor fails, the code falls back to jsonobjparse(metadatacopy, strlen(metadatacopy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIGUPDATEHUBDTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path.

The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadatacopy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write.

The fix zeroes metadatacopy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.