CVE-2026-15924— Zephyr 套接字TLS会话缓存并发访问UAF漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Zephyr 的 TLS socket 层（位于 ）维护了一个进程级的全局数组 ，用于缓存客户端会话，该数组被所有 TLS socket 上下文共享。负责修改和读取该数组的函数—— 、 、 以及配置恢复处理函数——会对每个条目的堆缓冲区（ ）进行分配、释放和解引用。在修复之前，对这些数据的访问仅通过每个 socket 上下文的互斥锁 （在 中为每个 socket 分配）进行序列化，但该锁无法在不同 socket 之间对共享缓存提供互斥保护。 由于 默认值为 1，任意两个并发的客户端 socket 会争用同一个缓存槽
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-15924 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
来源: CVE Program / CVE List V5
Vulnerability Description
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tls_session_save(), tls_session_get(), tls_session_cache_reset(), and the settings restore handler — allocate, free, and dereference each entry's heap buffer (entry->session). Before the fix these accesses were serialized only by the per-socket context mutex ctx->lock (assigned per socket in ctx_set_lock()), which provides no mutual exclusion between different sockets touching the shared cache.
Because CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT defaults to 1, any two concurrent client sockets contend for the same slot. A thread in tls_session_get() reading entry->session inside mbedtls_ssl_session_load() can run concurrently with another thread in tls_session_save() that selects the same entry for reuse and executes mbedtls_free(entry->session) before reallocating — a use-after-free read, and a double-free when two saves evict the same entry. Both corrupt the mbedTLS heap. The cache is reached on ordinary client paths: at connect time via tls_session_store()/tls_session_restore(), and (on main) whenever a TLS 1.3 session ticket arrives during recv()/poll() via tls_session_store_current().
Exploitation requires an application that opts into per-socket client session caching (the TLS_SESSION_CACHE socket option, off by default) and runs concurrent TLS client connections on multiple threads; the timing that opens the window is influenced by the remote peer(s), so a malicious or compromised server can raise session-ticket frequency to widen it. The reliably-demonstrable impact is memory corruption leading to a crash or heap corruption (denial of service). The fix adds a dedicated session_cache_lock mutex taken across every accessor of client_cache, serializing all reads and frees and closing the race.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
释放后使用
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.1.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-15924 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-15924 的情报信息
请登录查看更多情报信息。
CVE-2026-15924 补丁与修复 (1)
CVE-2026-15924 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-09-14 · 共 5 条
| CVE-2026-16147 | 6.8 MEDIUM | it82xx2 USB 控制器释放后使用及事件列表损坏 |
| CVE-2026-15893 | 6.5 MEDIUM | Zephyr IPv6邻居发现协议路由通告触发拒绝服务漏洞 |
| CVE-2026-15923 | 4.6 MEDIUM | Zephyr 文件系统 SDIO 拒绝服务漏洞 |
| CVE-2026-16148 | 4.6 MEDIUM | it82xx2驱动致内核恐慌 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-15924
暂无评论