Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-16514— Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述信息的中文翻译： 在 中的 函数会遍历接收到的 IEEE 802.1AS Announce 消息中的路径追踪 TLV，并将每个时钟标识与本地时钟标识进行比对。该循环的边界仅取自攻击者可控的有线字段 （最大接受值为 254），而未取自 ，后者才是表明 TLV 实际携带多少个标识字段的字段。由于 是有线 TLV（ ）中的柔性数组成员，且 返回的是指向接收报文缓冲区的原始指针，因此循环内部的 可能会访问超出接收帧末尾的内存区域。 栈中唯一的长度校验函数 要求接收到的 gPTP 负载长度必须恰好为 字节—

CVSS 4.3 · Medium EPSS 0.24% · P15

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 1.13.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16514

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved
Source: CVE Program / CVE List V5
Vulnerability Description
gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce->steps_removed (accepted up to 254), never from announce->tlv.len, which is the field that states how many identities the TLV actually carries. Because path_sequence is the flexible member of the wire TLV (struct gptp_path_trace_tlv) and GPTP_ANNOUNCE() yields a raw pointer into the received packet buffer, the memcmp() inside the loop can address memory well past the end of the received frame. The stack's only length validation, GPTP_ANNOUNCE_CHECK_LEN(), requires the received gPTP payload to be exactly 68 + tlv.len bytes — so it does not constrain the loop, it guarantees the data is absent. An unauthenticated attacker on the same Ethernet segment can send a single Announce frame declaring tlv.len = 0 with steps_removed = 254; the frame passes the length check and reception path (net_gptp_recv() → gptp_handle_msg() → gptp_mi_qualify_announce()), which performs no authentication, and the loop then reads 255 entries of 8 bytes each — about 2 KB — beyond the end of the network buffer. The impact is an out-of-bounds read. The bytes read are only used as a memcmp() operand and are never returned to the attacker, so there is no meaningful information disclosure; the practical risk is that the overread crosses a network buffer pool boundary into unmapped or MPU-protected memory and faults the networking RX thread, causing a denial of service. Exposure is limited to builds that enable the opt-in, experimental CONFIG_NET_GPTP (TSN/AVB deployments) and to attackers with layer-2 adjacency, since gPTP frames are sent to a link-local multicast address and are not routed. The fix computes the true entry count as tlv.len / GPTP_CLOCK_ID_LEN and rejects the announce when steps_removed + 1 exceeds it, so the loop can no longer run past the data the packet-length check proved present.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 1.13.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-16514

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16514

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-16514 (1)

Vendor Advisories for CVE-2026-16514 (1)

Same Patch Batch · zephyrproject · 2026-09-18 · 3 CVEs total

CVE-2026-16515 4.7 MEDIUM ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses
CVE-2026-16512 3.1 LOW Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-16514

No comments yet

Leave a comment