Input Length Validation Flaw in Zephyr Bluetooth Services

CVE-2024-8798

What is CVE-2024-8798?

CVE-2024-8798 is a critical vulnerability affecting the Zephyr Real-Time Operating System (RTOS). This flaw arises from the improper validation of the length of user input specifically within the olcp_ind_handler function located in the Bluetooth Object Transfer Service (OTS) implementation. Exploitation of this vulnerability could lead to overflow attacks, potentially allowing unauthorized access or Denial of Service (DoS) conditions. This vulnerability highlights the importance of ensuring robust input validation practices in software development, especially in connectivity protocols such as Bluetooth.

References