GHSA-mh5r-jxh8-hxwx: Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv(), the PTPMGMTTIME case casts mgmttlv->data to a 10-byte struct ptptimestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptptimestamp). Every sibling management id in the same switch validates its length first; PTPMGMTTIME was the only case lacking that check.

The length passed in is the management data size (tlv->length - 2), and the upstream guard in ptptlvpostrecv() only requires tlv->length > 2, while msgtlvpostrecv() validates only that the TLV fits within the received byte count, not a per-id minimum. A peer on the local PTP segment can therefore send a PTPMSGMANAGEMENT message carrying a short PTPMGMTTIME TLV (data as small as 2 bytes), causing the parser to read and write 8 bytes beyond the validated data. The message type and TLV contents are taken straight off the wire, so the path is reachable by any adjacent attacker when CONFIGPTP is enabled.

The over-read and write-back stay within the struct ptpmsg allocation (mgmttlv->data lives in the leading mtu[NETETHMTU] union member, so data + 10 lands at most a few bytes past mtu[], inside the same object), so this is an out-of-bounds read of adjacent in-object memory plus a bounded in-place corruption of the message's parsed timestamp, not past-allocation memory corruption. Impact is limited to minor information exposure of adjacent bytes and corruption of the device's parsed management TIME value; there is no crash on the access and no reachable reference-count corruption.

The fix adds if (length < sizeof(struct ptptimestamp)) { return -EBADMSG; } before the cast, matching the other management-id cases and fully closing the receive-path defect.