CVE-2026-13481: Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP
The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv(), the PTPMGMTTIME case casts mgmttlv->data to a 10-byte struct ptptimestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptptimestamp). Every sibling management id in the same switch validates its length first; PTPMGMTTIME was the only case lacking that check.
The length passed in is the management data size (tlv->length - 2), and the upstream guard in ptptlvpostrecv() only requires tlv->length > 2, while msgtlvpostrecv() validates only that the TLV fits within the received byte count, not a per-id minimum. A peer on the local PTP segment can therefore send a PTPMSGMANAGEMENT message carrying a short PTPMGMTTIME TLV (data as small as 2 bytes), causing the parser to read and write 8 bytes beyond the validated data. The message type and TLV contents are taken straight off the wire, so the path is reachable by any adjacent attacker when CONFIGPTP is enabled.
The over-read and write-back stay within the struct ptpmsg allocation (mgmttlv->data lives in the leading mtu[NETETHMTU] union member, so data + 10 lands at most a few bytes past mtu[], inside the same object), so this is an out-of-bounds read of adjacent in-object memory plus a bounded in-place corruption of the message's parsed timestamp, not past-allocation memory corruption. Impact is limited to minor information exposure of adjacent bytes and corruption of the device's parsed management TIME value; there is no crash on the access and no reachable reference-count corruption.
The fix adds if (length < sizeof(struct ptptimestamp)) { return -EBADMSG; } before the cast, matching the other management-id cases and fully closing the receive-path defect.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zephyr devices with CONFIG_PTP enabled are exposed when they can receive PTP traffic from peers on the local PTP segment. The vulnerable path processes management messages received directly from the network.
What does an attacker need to trigger the flaw?
An attacker needs adjacent access to the local PTP segment and must send a PTP_MSG_MANAGEMENT message containing a PTP_MGMT_TIME TLV with undersized data. No privileges or user interaction are required.
How can I determine whether my source tree contains the vulnerable logic?
Inspect subsys/net/lib/ptp/tlv.c in tlv_mgmt_post_recv(). The vulnerable PTP_MGMT_TIME case handles its data as a struct ptp_timestamp without first verifying that the management data length is at least sizeof(struct ptp_timestamp).