CVE-2026-13343— MIDI 2.0 UMP 流响应者未初始化栈内存泄露漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是该漏洞描述信息的中文翻译： 在 中的 UMP Stream 响应库，使用一个 16 字节的 （由 组成）来构建回复数据包。函数 和 仅填充前两个字（即 和 ），而在修复之前，它们将结果声明为未初始化的局部变量（ ）。因此，剩余的两个字（ 和 ）会保留栈上残留的旧数据。 Endpoint Info 和 Function Block Info 通知属于 UMP Stream 消息（ ），长度为 4 个字（16 字节）。因此，整个 16 字节的数据包——包括两个未初始化的字——会通过 原封不动地发送出去。该响应器由
可能的 ATT&CK 技术 1 AI
T1005 · Data from Local System
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-13343 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
来源: CVE Program / CVE List V5
Vulnerability Description
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.
Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.
Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.
The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
信息暴露
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.3.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-13343 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-13343 的情报信息
请登录查看更多情报信息。
CVE-2026-13343 补丁与修复 (1)
CVE-2026-13343 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-08-24 · 共 4 条
| CVE-2026-13212 | 8.8 HIGH | Zephyr virtio 驱动使用越界描述符 ID 调用任意函数指针漏洞 |
| CVE-2026-9728 | 6.4 MEDIUM | mbox_send系统调用TOCTOU竞态导致内核内存泄露 |
| CVE-2026-13213 | 5.3 MEDIUM | 蓝牙HAS：bonded对等体重连时的空指针解引用DoS漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-13343
暂无评论