Potential buffer overflow vulnerability in the Zephyr CANbus subsystem
CVE-2023-3725

7.6HIGH

Key Information:

Vendor

Zephyrproject-rtos

Status
Zephyr
Vendor
CVE Published:
6 October 2023

What is CVE-2023-3725?

A buffer overflow vulnerability exists in the CAN bus subsystem of the Zephyr Real-Time Operating System (RTOS), posing potential risks to system integrity. When exploited, this vulnerability could lead to unexpected behavior, such as denial of service or arbitrary code execution, impacting the reliability of connected devices that utilize this subsystem. It is crucial for users and developers to review the advisory and update to the latest software versions to mitigate this risk.

Affected Version(s)

Zephyr * <= 3.4

References

https://github.com/zephyrproject-rtos/zephyr/security/adv...
http://www.openwall.com/lists/oss-security/2023/11/07/1
http://seclists.org/fulldisclosure/2023/Nov/1

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.