6 matches found
CVE-2026-18418
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418
The zbus proxy agent IPC backend in Zephyr (specifically zbus_proxy_agent_ipc.c) is vulnerable to an out-of-bounds read when logging rejected inter-domain frames. The vulnerability occurs because the channel_name[] array in struct zbus_proxy_msg may lack NUL-termination, and the logging logic use...
PT-2026-83844
Subject::new for owner in the zbus polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit...
