Zephyr RTOS coredump shell array out-of-bounds read vulnerability advisory

Vulnerability Overview In the function within , the 16-bit field of the stored Zephyr coredump header is used as an index into the array. This array is a fixed-size array of string pointers with a length of 7, and no boundary checking is performed. When is greater than or equal to 7, it results in an out-of-bounds read on a type, potentially exceeding the array bounds by up to 64K bytes. This value is passed as a argument to , which dereferences it and treats it as a string. This may result in the leakage of device memory contents, a crash of the shell user, or a crash if the out-of-bounds pointer is unmapped. This vulnerability is triggered via the shell command ( ). The field is generated by the device during normal crash handling and is within range in the flash memory backend. However, triggering this vulnerability requires local shell access, which allows for storing or tampering with the stored coredump in the flash memory backend. Affected Versions Affected Versions: - Zephyr >= 4.2.0, = 4.4.0, <= 4.4.1 Affected Components: - Remediation Fixed Versions: - Zephyr 4.3.1 - Zephyr 4.5.0 Fix Method: - The issue is fixed by clamping out-of-bounds codes to "unknown" (index 0). Fix Commits: - Merged to branch: PR #10630 - Merged to branch: PR #111421 - Merged to branch: PR #111422 Evidence — has exactly 7 entries. — is used directly as an array index without boundary checking, and the result is passed to . — is a 16-bit field within , meaning the index can reach up to 65535. — Pre-fix: closes the DOB (Dereference Out of Bounds) vulnerability. — Call path: (shell restricted). — The header is typically written by the device with a valid range (within normal usage bounds). Git tag containing — Introduced vulnerable code in v4.2.0 and v4.4.0. More Information For any questions or comments, please open an issue here: Zephyr Contact us here: Zephyr-vulnerabilities embargo: 2026-07-28

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr RTOS coredump shell array out-of-bounds read vulnerability advisory

More from this source