zephyr

.. raw:: html Il Progetto Zephyr è un sistema operativo in tempo reale RTOS scalabile che supporta molteplici architetture hardware, ottimizzato per dispositivi con risorse limitate, e progettato con la sicurezza in mente. Il sistema operativo Zephyr si basa su un kernel a basso ingombro progetta...

advisories

advisories "Il testing può dimostrare la presenza di bug, ma non la loro assenza." -- Edsger W. Dijkstra Una raccolta dei miei avvisi di sicurezza pubblici. Vedi anche https://github.com/hnsecurity/vulns https://hnsecurity.it/blog/author/marco-ivaldi/ Avvisi di sicurezza Linux CVE-2006-1242...

vulns

Segnalazioni di vulnerabilità Avvisi di HN Security. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Diverse vulnerabilità in Solaris dtprintinfo e libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Diverse vulnerabilità in Zyxel zysh CVE-2022-26531...

zephyr_cve-2021-3625

CVE-2021-3625 Dieses Repository enthält einige Beispiel-Exploits für CVE-2021-3625. Alle Zephyr-basierten USB-Geräte bis einschließlich Version 2.5.0 leiden unter einem Pufferüberlauf, der das Auslesen von bis zu 65 kB ermöglicht. Abhängig vom tatsächlichen Gerät kann dies zum Verlust sensibler...

CVE-2026-8023

CVE-2026-8023 — Path traversal del static-fs HTTP di Zephyr PoC Path traversal pre-autenticazione nel gestore static-fs del server HTTP di Zephyr subsys/net/lib/http quando il resource matching wildcard CONFIGHTTPSERVERRESOURCEWILDCARD=y viene usato con HTTPRESOURCETYPESTATICFS. Colpisce sia...

tinyos-rtos

TinyOS — RTOS ultra-leggero per IoT Un sistema operativo real-time ultra-leggero per dispositivi IoT e embedded con risorse limitate. Impronta del kernel inferiore a 10 KB, 2 KB di RAM minima, scheduling preemptive basato su priorità. Caratteristiche Categoria| Dettagli ---|--- Kernel| Scheduling...

CVE-2026-13217

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...

CVE-2026-13216

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

draytek-arsenal

Draytek Arsenal: Toolkit di osservabilità e hardening per dispositivi edge Draytek. Gli attaccanti avanzati scelgono sempre più spesso i dispositivi edge come bersagli. Tuttavia, questi dispositivi sono controllati da software closed-source noto come firmware, spesso distribuito in un formato...

CVE-2026-13214

A stack buffer overflow in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp/ocpp_j.c, function parse_getconfig_msg()) results from an unbounded strcpy() of an attacker-controlled JSON "key" string into a fixed 50-byte stack buffer (skey[CISTR50]). The key is parsed from a GetConfiguration mes...

RTOS-F-16-Exploit---CVE-2019-7711

Exploit Green Hills INTEGRITY RTOS F-16 - CVE-2019-7711 Catena completa di sfruttamento di Format String Attacco realistico di manutenzione a terra su avionica F-16 📋 Descrizione Questo repository contiene un Proof of Concept PoC per CVE-2019-7711 — una vulnerabilità di Format String nel server...

EUVD-2026-65003

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13343

CVE-2026-13343 affects the Zephyr RTOS UMP Stream responder library (lib/midi2/ump_stream_responder.c). The functions make_endpoint_info() and make_function_block_info() declare a local struct midi_ump without initialisation, populating only the first two of four uint32_t words. The remaining two...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

CVE-2026-9728

CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...

CVE-2026-12634

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...

CVE-2026-9771

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-12630

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...