“When hackers tell me it’s so hard to find bugs, I tell them to stop looking for hard bugs.”
— Dave Aitel
Summary
The Zephyr Project is an open source collaborative effort sponsored by the Linux Foundation. It unites developers and users in building a best-in-class, small, scalable, real-time operating system (RTOS) optimized for resource-constrained IoT devices, across multiple microcontroller architectures.
I reviewed Zephyr’s source code hosted on GitHub and identified multiple security vulnerabilities that may cause memory corruption. Their impacts range from denial of service to potential arbitrary code execution.
My detailed advisory is available here: https://github.com/hnsecurity/vulns/blob/main/HNS-2023-03-zephyr.txt
Background
After my recent, less than pleasant coordinated disclosure experiences, I became fed up with having to deal with commercial vendors. In my endless endeavor to become a better security researcher, I decided to try to meaningfully contribute to open source projects instead.
At about the same time, I stumbled upon the OpenSecurityTraining2 (OST2) project that provides world-class, free security training. While going through their awesome (and much recommended!) Vulns1001 and Vulns1002 training courses, I discovered the Zephyr Project. It immediately picked my interest and therefore I decided to review its source code.
During the review, I made heavy use of my Semgrep C/C++ ruleset to identify hotspots in code on which to focus my attention. I also took advantage of this opportunity to improve the ruleset.
Vulnerabilities
The vulnerabilities resulting from my source code review are:
- CVE-2023-3725 – Buffer overflow vulnerability in the Zephyr CANbus subsystem
- CVE-2023-4257 – Unchecked user input length in the Zephyr WiFi shell module
- CVE-2023-4259 – Buffer overflow vulnerabilities in the Zephyr eS-WiFi driver
- CVE-2023-4260 – Off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
- CVE-2023-4261 – Buffer overflow vulnerability in the Zephyr IPC subsystem (unreleased)
- CVE-2023-4262 – Buffer overflow vulnerabilities in the Zephyr Mgmt subsystem
- CVE-2023-4263 – Buffer overflow vulnerability in the Zephyr IEEE 802.15.4 driver
- CVE-2023-4264 – Buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
- CVE-2023-4265 – Two buffer overflow vulnerabilities in Zephyr USB code
- CVE-2023-5139 – Buffer overflow vulnerability in the Zephyr STM32 Crypto driver
- CVE-2023-5184 – Signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver
- CVE-2023-5753 – Other buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
After all, what better way to celebrate 20 years since my first CVE than with a bunch of brand new CVEs? 😉
I've just noticed today that it's been #20years since I've got my first #CVE (actually it was a "CAN" back then). https://t.co/KMLUqZBdeV
The exploit is #25 on @exploitdb 😜https://t.co/FBsK25dI5H
Time flies when you're having fun!#vulnerability #research #exploitation
— [email protected] (@0xdea) August 14, 2023
For additional information about these vulnerabilities and their fixes, please refer to the detailed advisory.
Disclosure and fixes
I reported the vulnerabilities discussed in this article to the Zephyr Project between May and July 2023, using GitHub’s security advisories feature. Private vulnerability reporting allows security researchers to report vulnerabilities securely in a repository. It’s an excellent way to streamline coordinated disclosure and I wish more maintainers enabled it.
On October 20th, 2023 the Zephyr Project has released version 3.5.0 of their RTOS that contains fixes for all vulnerabilities discussed in this advisory, except for CVE-2023-4265 that was was already fixed in Zephyr 3.4.0 and CVE-2023-4261 that will be fixed in a future update.
Please check the official Zephyr Project channels for further information about fixes and backported patches for older but still maintained releases of the Zephyr RTOS.
Acknowledgments
I would like to thank the Zephyr’s Project development team and Flavio Ceolin in particular for triaging and fixing the reported vulnerabilities.