Zephyr OS IP Packet Handling Vulnerability
CVE-2023-7060

7.5HIGH

Key Information:

Vendor

Zephyrproject-rtos

Status
Zephyr
Vendor
CVE Published:
15 March 2024

What is CVE-2023-7060?

A vulnerability in Zephyr OS's IP packet handling mechanisms has been identified, where the system fails to correctly drop IP packets arriving on an external interface if the source address is 127.0.0.1 or if the destination address matches the same criteria. This flaw can lead to unauthorized packet processing, potentially impacting the integrity and security of the network operations performed by Zephyr OS.

Affected Version(s)

Zephyr * <= 3.5

References

https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.