目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2026-16512— Zephyr gPTP接收路径短帧越界读取漏洞

一分钟漏洞结论

影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

中的 函数在通过 获取 gPTP 头部后，直接解引用该头部并根据 进行分支处理，但之前并未检查接收到的帧是否至少包含 （即 34）字节的负载。 头部访问器函数 特意设计为对于短缓冲区永远不返回错误——它直接返回 ，并将验证工作留给调用者。因此，一个被截断的帧会生成一个指向超出实际接收数据范围的内存区域的头部指针。 后续针对每种消息类型的检查无法弥补这一缺陷：在剥离以太网头部之后， 简化为 。由于所有固定大小的 gPTP 消息都不满足此条件，因此 永远不会拒绝被截断的 SYNC、FOLLOW_UP、PDELAY_RE

CVSS 3.1 · Low EPSS 0.17% · P7

影响版本矩阵 1

厂商产品 版本范围状态
zephyrproject zephyr 1.13.0< 4.4.2 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-16512 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
来源: CVE Program / CVE List V5
Vulnerability Description
gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that the received frame carries at least sizeof(struct gptp_hdr) (34) bytes of payload. The header accessor gptp_get_hdr() deliberately never fails for a short buffer — it returns pkt->frags->data and leaves validation to its callers — so a truncated frame produced a header pointer covering memory beyond the received data. The per-message-type checks that follow do not compensate: GPTP_VALID_LEN() reduces to len > 60 once the Ethernet header has been pulled, which is false for every fixed-size gPTP message, so GPTP_CHECK_LEN() never rejects a truncated SYNC, FOLLOWUP, PDELAY_RESP or SIGNALING message. The defect is reached by an unauthenticated peer on the same link sending an Ethernet frame with ethertype 0x88F7 to the PTP multicast address on an interface configured as a gPTP port, with CONFIG_NET_GPTP enabled. Because conformant Ethernet pads frames to 60 bytes, a payload shorter than 34 bytes generally requires a link that can deliver sub-minimum frames — for example the native_sim TAP driver (drivers/ethernet/eth_native_tap.c), which forwards whatever length the host device supplies, or a MAC configured to accept undersized frames. The short packet is retained (net_pkt_ref() into rcvd_sync_ptr, rcvd_follow_up_ptr, rcvd_pdelay_resp_ptr or rcvd_announce_ptr) and later parsed by the media-dependent and media-independent state machines in subsys/net/l2/ethernet/gptp/gptp_md.c and subsys/net/l2/ethernet/gptp/gptp_mi.c, which read tens of further bytes and copy some of them (the announce priority vector, hdr->port_id) into state that is subsequently transmitted. Under the default fixed-size buffer allocator (CONFIG_NET_BUF_FIXED_DATA_SIZE, 128-byte fragments) the accesses stay inside the allocated fragment and disclose stale recycled buffer contents; under the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator, where fragments are heap-allocated at the exact frame length, they are genuine out-of-bounds reads. There is no write and no availability impact.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
zephyrproject zephyr 1.13.0 ~ 4.4.2 -

二、漏洞 CVE-2026-16512 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-16512 的情报信息

请登录查看更多情报信息。

CVE-2026-16512 补丁与修复 (1)

CVE-2026-16512 厂商安全公告 (1)

同批安全公告 · zephyrproject · 2026-09-18 · 共 3 条

CVE-2026-16515 4.7 MEDIUM Zephyr IPv6协议栈ICMPv6网络放大漏洞
CVE-2026-16514 4.3 MEDIUM OpenLiteOS gPTP Announce路径跟踪越界读取漏洞

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-16512

暂无评论

发表评论