github zephyrproject-rtos/zephyr v4.3.2
Zephyr 4.3.2
on GitHub

3 hours ago

This is a bugfix release for Zephyr 4.3.1.

Security Vulnerability Related

The following CVEs are addressed by this release:

More detailed information can be found in:
https://docs.zephyrproject.org/latest/security/vulnerabilities.html

Issues fixed

The following issues are addressed by this release:

  • #99527 - subsys: net/lib/ptp: wrong use of CONTAINER_OF with struct ptp_tlv_mgmt *
  • #103831 - Add mcxc242 lpuart dma support (async api)
  • #110548 - zephyr/drivers/i2c/target/eeprom_target.c array index out of bounds at eeprom_target_buf_read_requested
  • #110849 - bluetooth: classic: sdp: bt_sdp_parse_attribute() reads one byte past the buffer end
  • #110854 - bluetooth: classic: rfcomm: session stuck and L2CAP channel leaked when both sides disconnect simultaneously
  • #111031 - tests/drivers/can/api/drivers.can.api fails on mutex
  • #111087 - kernel: k_thread_name_copy() syscall dereferences NULL for an unregistered thread pointer
  • #111100 - kernel: pipe: a user thread can re-initialize a pipe that is already in use
  • #111110 - kernel: poll: z_vrfy_k_poll() leaks events_copy when a k_poll_event carries an invalid object handle
  • #111116 - pmci: mctp: I2C+GPIO target writes received bytes through an unchecked/unallocated packet buffer
  • #111119 - drivers: spi: dw: spi_dw_configure() uses config->frequency as a divisor without validating it
  • #111199 - release: Zephyr v4.3.1
  • #111277 - Neighbor solicitation header hop limit issue when CONFIG_NET_IPV6_ROUTE_MCAST is enabled
  • #111345 - net: http_server: static filesystem handler serves files outside the web root for paths containing ".."
  • #111416 - logging: z_vrfy_log_filter_set() accepts a negative src_id and indexes outside log_dynamic
  • #111420 - debug: coredump/shell: out-of-bounds read printing a stored coredump's target
  • #111431 - net: ip: forwarded packets keep their original TTL / hop-limit (no decrement on the routing path)
  • #111534 - Bluetooth: GATT: notify/indicate checks the declaration's permissions, not the value's, when passed a characteristic declaration
  • #111564 - bluetooth: host: classic: l2cap_br: Fix conf req/rsp length validation
  • #112204 - net: sockets: recvmsg() ancillary write checks total buffer, not room at the chosen slot
  • #112211 - Bluetooth: BAP: UC: NULL stream->group dereference on QoS Configured notification
  • #112621 - llext: ELF loader indexes arrays and sizes a stack VLA from unvalidated module header fields
  • #113159 - LVGL Dynamic allocation doesn't work
  • #113372 - update Mbed TLS to 3.6.7
  • #113487 - TF-M broken FOTA when updating from Zephyr v4.2
  • #114495 - drivers: can: stm32: bxcan: maximum filter ID should not take split-filter banks into consideration
  • #114856 - obj_core: stack-local k_sem leaves dangling list tail (UAF on next k_sem_init)
  • #115285 - tests: tests/drivers/adc/adc_api: frdm_ke15z/mke15z7: failed: Testsuite failed
  • #115320 - IP_MULTICAST_LOOP has no effect on an Ethernet interface
  • #115460 - net: ptp: Announce messages advertise the Sync interval as logMessageInterval
  • #115879 - Bluetooth: Host: ATT Signed Writes stop working after reboot when using CONFIG_BT_SETTINGS
  • #116030 - drivers: i2s: four drivers map SYS_FOREVER_MS to K_NO_WAIT instead of K_FOREVER
  • #116169 - cmake: dts changes do not cause Kconfig .config file to be updated
  • #116523 - Bluetooth: Host: L2CAP dynamic channel RX work is not canceled when the channel is destroyed
  • #116631 - Bluetooth: ISO: Missing SDU len checks
  • #116732 - Bluetooth: CAP: Wrong bt_bap_unicast_group_stream_param array size
  • #116738 - Bluetooth: CAP: bt_cap_unicast_group_create does not output NULL group on failure
  • #117018 - Bluetooth: OTS: Client: Missing call to callback obj_checksum_calculated
  • #117045 - bluetooth: classic: rfcomm: MCC handlers read past the received buffer on short frames
  • #117059 - drivers: charger: charger_get_prop() handler copies an uninitialized temporary back to the caller
  • #117129 - mcumgr: serial transport reads the frame header unaligned, faults on ARMv8-M Baseline
  • #117207 - mgmt: mcumgr: os: echo command replies to a request that carries no "d" key with a NULL-backed string
  • #117579 - Bluetooth: Classic: SDP: client attribute ID list length wraps and overflows the request PDU
  • #117587 - Bluetooth: Host: Periodic advertising report length not validated against event payload
  • #117703 - drivers: can: mcan: RX frame flags not always cleared
  • #117723 - fs: duplicate-fs_data detection in fs_mount() is unreachable for mount points of differing length
  • #117779 - subsys: fs: ext2: validate on-disk metadata before directory and block access
  • #117807 - Zephyr HTTP debug logging can read past parser-provided header slices
  • #117811 - Zephyr SOCKS5 client can read out of bounds when proxy and destination use different address families
  • #117883 - net: http: server: HTTP/2 static filesystem handler overwrites the connection RX length
  • #117884 - net: http: server: HTTP/2 static filesystem response fails when no compressed variant is served
  • #118137 - subsys: fs: ext2: release temporary blocks on metadata write failure
  • #118138 - subsys: fs: ext2: handle allocation errors safely during format
  • #118139 - subsys: fs: ext2: roll back inode allocation when creation fails
  • #118140 - subsys: fs: ext2: do not skip inodes while unmounting
  • #118141 - subsys: fs: ext2: define cleanup semantics after failed close
  • #118142 - subsys: fs: ext2: preserve partial I/O results after block errors
  • #118521 - arch: riscv: stacktrace: bogus frame in non-leaf function
  • #118547 - CAN mcp251xfd driver FD mode disabled overflow
  • #118640 - net: ptp: timer timeout path performs eventfd write from ISR context
  • #118833 - net: http: server: NULL dereference on HTTP/2 CONTINUATION frames
  • #118834 - net: ipv4: fragment reassembly leaks packets on net_pkt_get_data() failure
  • #118952 - Bluetooth: Classic: AVDTP/A2DP: session reuse re-initializes a still-queued release work item
  • #118955 - drivers: can: RX filter keeps using a message queue after user mode frees it
  • #118959 - Bluetooth: GATT: notification values longer than the maximum attribute length are delivered to subscribers
  • #119035 - Bluetooth: Controller: received PDU length is not checked against the configured maximum receive length
  • #119039 - rtio: syscall verifiers accept inaccessible buffers and unowned SQE handles
  • #119046 - drivers: i3c: i3c_transfer() handler validates target->bus but dispatches on a value it re-reads
  • #119091 - net: ptp: Delay_Resp logMessageInterval is adopted without range checking
  • #119097 - drivers: serial: uart_renesas_ra_sci: ERI ISR does not acknowledge the interrupt when no callback is registered
  • #119098 - kernel: memory mapped thread stack is leaked when a thread is aborted by another thread
  • #119107 - usb: host: device init returns success for a device with no configurations
  • #119144 - net: ip: ipv6: Fix integer underflow in ext hdr option check
  • #119366 - xtensa: thread->arch.ptables is left uninitialized for new threads, causing a bogus page-table walk
  • #119378 - drivers: ethernet: nxp_enet_qos: RX stops after a dropped frame and TX stops after a link drop
  • #119386 - drivers: serial: u16 syscall verifiers check the 8-bit driver op
  • #119396 - net: ptp: Sync logMessageInterval is adopted without range checking
  • #119410 - drivers: eeprom: simulator: range check accepts negative offsets
  • #119442 - net: if: refused net_if_ipv4_addr_rm() leaves the address PREFERRED, and a repeat call consumes another holder's reference
  • #119443 - net: ipv6: nbr: NS reply timeout re-queues a pending packet without dropping the queue's reference (TX net_pkt leak)
  • #119445 - net: ethernet: arp: failed ARP request after NET_ARP_PKT_REPLACED unrefs the original packet twice
  • #119498 - net: ipv6: Valid NA/RA packets with no options are dropped
  • #119602 - net: ipv6: Retrans Timer from a Router Advertisement is stored byte-swapped
  • #119632 - zms: silent mount failure, data corruption
  • #119689 - net: if: net_if_try_send_data() reads the packet after a prepare_for_send() handed it away (use after free)
  • #119812 - net: mqtt_sn: Check remaining length before the extended length field
  • #119982 - net: virtual: virtual_recv() invokes dev->api->recv on non-virtual interfaces
  • #119986 - drivers: charger: syscall verifiers ignore prop and copy out an uninitialized propval union
  • #119992 - mgmt: ec_host_cmd: shi_ite: SPI interrupt is unmasked before the rx context is assigned
  • #120002 - net: websocket: Sec-WebSocket-Accept is accepted on a prefix match, and logged as an unterminated string
  • #120008 - bluetooth: host: att: bt_att_find_req_by_user_data() dereferences an idle channel's NULL req
  • #120009 - drivers: i3c: dw: unsigned get_free_pos() makes the full-DAT check dead code
  • #120044 - drivers: ethernet: smsc911x: out-of-bounds writes and reads on the TX staging buffer
  • #120072 - net: ip: Fragment reassembly races with the reassembly timeout handler
  • #120157 - dfu: img_util: flash_img picks the wrong upload slot in RAM load with revert mode
  • #120385 - Uninitialized Stack Variable in can_sock_setsockopt_vmeth Leads to Arbitrary vTable Hijacking
  • #120842 - net: tcp: tcp_pkt_linearize() frees the rest of the fragment chain when the TCP header is split
  • #120843 - bluetooth: audio: LE Audio connection callbacks handle BR/EDR connections and crash on dual-mode builds
  • #120845 - drivers: i2c_sedi: stale completion after a transfer timeout lets the next transfer return early
  • #120920 - net: tftp: client accepts the first reply from any source address
  • #120967 - Bluetooth: Mesh: First Index not validated in Firmware Distribution Receivers Get
  • #121149 - drivers: pwm: pwm_capture_cycles() falls through on K_NO_WAIT and leaves the capture armed
  • #121150 - drivers: sensor: grow_r502a: UART RX path writes past the caller's packet buffer
  • #121151 - drivers: i3c: dw: dw_i3c_do_ccc() dereferences a NULL CCC buffer when data_len is non-zero
  • #121152 - kernel: k_thread_stack_space_get() verifier ignores a failed object check under CONFIG_NO_RUNTIME_CHECKS
  • #121153 - mgmt: mcumgr: smp_client: response matched to the wrong pending command
  • #121155 - drivers: i3c: dw: direct CCC with more than 16 targets writes past the command array
  • #121156 - net: tftp: client passes an unterminated ERROR message to the callback
  • #121157 - net: ieee802154: 6LoWPAN reassembly timeout handler races the RX path on the fragment cache
  • #121158 - drivers: ethernet: stm32: RX stalls permanently after a frame is dropped (HAL API v2)
  • #121160 - net: sockets: getsockopt() user-mode verifier dereferences optlen without validation
  • #121161 - drivers: bbram: bbram_read()/bbram_write() from user mode accept a wrapping offset and access memory below the BBRAM region
  • #121162 - Bluetooth: Classic: BR/EDR SDU reassembly is unbounded and GOEP RX allocation blocks the RX workqueue
  • #121336 - drivers: serial: esp32: async RX leaves RXFIFO interrupts enabled after RX stops, causing an interrupt storm
  • #121376 - lib: websocket refcount underflow on double disconnect; SYS_FOREVER ops ignore socket timeouts; mqtt_ws returns -errno for coded errors
  • #121845 - drivers: can: mcan: NULL Tx callback called when bus-off and a Tx event are handled together
  • #121900 - net: l2: ieee802154: 6LoWPAN fragments with unsupported dispatch values bypass the header length check
  • #121905 - net: tcp: out-of-order receive queue trims the wrong fragment
  • #122005 - net: ptp: PTP thread blocks forever when the message or TLV pool is empty
  • #122050 - drivers: clock_control: stm32u3: build warning without MSIK
  • #122055 - net: tcp: RFC 6528 ISN hash uses a 16-byte buffer for SHA-256 and ignores the PSA status
  • #122059 - drivers: wifi: winc1500: socket IDs from the module index socket_data[] without a bounds check
  • #122064 - net: lwm2m: JSON/SenML write records bypass access checks on payload paths
  • #122070 - net: lib: coap: client: one malformed datagram cancels all ongoing requests
  • #122084 - net: ptp: a single invalid received message faults and re-initializes the port
  • #122085 - ec_host_cmd: spi_stm32: CS toggle while busy re-arms RX DMA over the request being processed
  • #122086 - net: ipv6: nbr: neighbor interface read after the neighbor lock is released can be NULL
  • #122087 - ec_host_cmd: request length check wraps at 16 bits and malformed requests are logged before verification
  • #122088 - drivers: hwinfo: reset-cause syscalls copy uninitialized stack data to user mode
  • #122233 - drivers: i2c: target register/unregister syscall verifiers check the wrong device type
  • #122234 - drivers: i3c: do_ccc syscall handler accepts a NULL CCC buffer with a nonzero length
  • #122235 - drivers: modem: quectel-bg9x: ICCID prefix strip copies the whole line length, overrunning mdm_iccid
  • #122659 - Bluetooth: Mesh: BLOB Transfer Client faults on BLOB Block Status received before first procedure
  • #122777 - Bluetooth: Controller: nRF: Preempted ECB calls with EasyVDMA can return incorrect results or fault
  • #123065 - [Backport v4.3-branch] Failed to backport #122709
  • #123073 - Bluetooth: Host: hci_cmd_done() copies a long command response past the end of the command buffer
  • #123074 - drivers: usb: udc: rpi_pico/renesas_ra hand a still-queued buffer back to the stack when starting a transfer fails
  • #123075 - net: ip: NET_CMSG_NXTHDR() does not stop at a control message header with an invalid length
  • #123076 - net: ipv6: Host re-sends unicast packets not addressed to it, without decrementing the hop limit
  • #123094 - drivers: led: led_write_channels() syscall accepts a start_channel that wraps the channel range
  • #123095 - Bluetooth: Classic: RFCOMM: RTX timer left armed when bt_rfcomm_dlc_connect() fails
  • #123096 - Bluetooth: Classic: L2CAP: buffer freed while a recv() returning -EINPROGRESS still owns it
  • #123097 - Bluetooth: Controller: ISO Rx buffers leak on each BIG sync terminate
  • #123180 - Bluetooth: Controller: ticker start lost when ticker job is preempted by a ticker user
  • #123345 - kernel: stack: k_stack_push() writes past the buffer when runtime error checks are disabled
  • #123346 - net: ethernet: bridge: frame is leaked when no other bridge port is up
  • #123347 - canbus: isotp: short consecutive frame writes past the receive buffers
  • #123349 - drivers: usb: udc_max32: buffer handed to the stack while still queued when a transfer fails to start
  • #123350 - bluetooth: mesh: blob_cli: division by zero on BLOB Block Status with Chunk Size 0
  • #123356 - Bluetooth: L2CAP: TX stalls behind a channel that has no credits for a new K-frame
  • #123359 - net: if: net_if_add_tx_timestamp() takes its packet reference after queueing, freeing a packet still in use
  • #123362 - Bluetooth: GATT: Multiple Handle Value Notification frees a failed batch twice and undercounts the PDU length
  • #123364 - Bluetooth: ATT: queued request too large for a bearer stalls all later requests
  • #123369 - Bluetooth: Controller: extended advertising parsers walk an extended header without checking its length
  • #123386 - net: context: net_context_packet_received() can call a NULL recv_cb after unlocking
  • #123387 - net: utils: net_addr_ntop() from user mode copies uninitialized bytes past the terminator
  • #123669 - Bluetooth: Controller: Incorrect auxiliary offset during extended scanning
Check out latest releases or
releases around zephyrproject-rtos/zephyr v4.3.2

Don't miss a new zephyr release

NewReleases is sending notifications on new releases.

Get notifications