8 matches found
CVE-2026-16512
gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...
CVE-2026-16514 Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved
gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...
EUVD-2026-82948
gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...
CVE-2026-16514
CVE-2026-16514 is an out-of-bounds read in Zephyr RTOS 's gPTP implementation (gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c). The loop bound for validating the Path Trace TLV of IEEE 802.1AS Announce messages was taken from the attacker-controlled steps_removed field (up to...
CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...
CVE-2026-16512
CVE-2026-16512 is an out-of-bounds read in the Zephyr RTOS gPTP (generalized Precision Time Protocol) receive path. In gptp_handle_msg() (subsys/net/l2/ethernet/gptp/gptp.c), the gPTP header is dereferenced without verifying the frame carries at least 34 bytes of payload. The GPTP_VALID_LEN() che...
EUVD-2026-82947
gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...
