Vulnerabilidades em zephyrproject
206 resultadosAnálise Vexday
O Zephyr Project apresenta panorama atípico: 40 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando descoberta recente concentrada em um curto período. Nenhuma está sob exploração ativa (KEV) e não há críticas por CVSS, sugerindo severidade moderada; a fraqueza dominante (CWE-416 - use-after-free) aponta para falhas de gerenciamento de memória, típicas em projetos de firmware/RTOS. O risco imediato de exploração é baixo, mas o volume recente exige revisão arquitetural do código.
CVE-2026-18413HIGHOut-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validationEPSS 0.1%CVE-2026-11985LOWCross-thread FPU register leak on ARM when FPU enabled without register sharingEPSS 0.1%CVE-2026-79981MEDIUMDNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingEPSS 0.1%CVE-2026-19575HIGHType confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel codeEPSS 0.1%CVE-2026-10681MEDIUMSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotEPSS 0.1%CVE-2026-87041HIGHInverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryEPSS 0.1%CVE-2026-19736HIGHOut-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengthsEPSS 0.1%CVE-2026-9728MEDIUMTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryEPSS 0.1%CVE-2026-18418LOWOut-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel nameEPSS 0.1%CVE-2026-12234HIGHTOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds writeEPSS 0.1%CVE-2026-78118HIGHRace condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMPEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%CVE-2026-19738MEDIUMRetained RX node leak and reachable assertion in Bluetooth Controller CIS Create proceduresEPSS 0.1%CVE-2026-11812LOWUpdateHub: race condition on shared context causes out-of-bounds write and DoSEPSS 0.1%CVE-2026-19184HIGHOut-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatchEPSS 0.1%CVE-2026-79979HIGHStale TLB entries after demand-paging page-out let arm64 user threads access reused physical framesEPSS 0.1%CVE-2026-19739MEDIUMBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateEPSS 0.1%CVE-2026-87039HIGHI2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to driversEPSS 0.1%CVE-2026-19737MEDIUMNULL pointer dereference in the ESP32 I2S driver when triggering an unsupported directionEPSS 0.1%CVE-2026-19574HIGHARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolationEPSS 0.1%