Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

Possible buffer overflow  in Zephyr mgmt subsystem when asserts are disabled

Unchecked length coming from user input in settings shell

Signed to unsigned conversion esp32ipmsend

can: out of bounds in removerxfilter function

Possible buffer overflow in ismountpoint

Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

Unchecked user input length in /subsys/net/l2/wifi/wifishell.c can cause buffer overflows.

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sysringbufput(), sysringbufget() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sysringbufget() and sysringbufput).

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.

Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44

Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.

There is an error in the condition of the last if-statement in the function smpcheckkeys. It was rejecting current keys if all requirements were unmet.

Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.

Possible variant of CVE-2021-3434 in function leecredreconfreq.

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.

usb device bluetooth class includes a buffer overflow related to implementation of netbufaddmem.

A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in lereadbuffersizecomplete.

Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack

When the Global Pointer (GP) relative addressing is enabled (CONFIGRISCVGP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.

The function dnscopyqname in dnspack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.