Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hcicore.c

Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

Unchecked user input length in /subsys/net/l2/wifi/wifishell.c can cause buffer overflows.

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIGCANAUTOBUSOFFRECOVERY=y. This results in calling ksleep() in IRQ context, causing a fatal exception.

Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

Possible variant of CVE-2021-3434 in function leecredreconfreq.

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.

Possible buffer overflow  in Zephyr mgmt subsystem when asserts are disabled