Zephyr OS PTP Out-of-Bounds Read Fix in ptp_msg_post_recv

Vulnerability Overview This vulnerability involves an out-of-bounds read in the function, where the index into the array is derived directly from the network as a 4-bit message type (0-15). However, the array only contains entries up to (0x0). Receiving a message of type 0x8 or 0x9 results in an out-of-bounds read, which may lead to a crash or data leak. Scope of Impact Affected File: Affected Function: Specific Code Lines: 402-405 Remediation Add a check for the message type before indexing into to ensure it does not exceed . If the type is out of range, log an error and return . Patch Code Original Code Commit Information Committer: nashif Commit Date: Jun 17 Commit Hash: 30dabd4 Signature: Anna Nashif Additional Information Files Changed: 1 file modified Code Review: 1 file reviewed Comments: 0 comments Page Navigation Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign In: Sign in Sign Up: Sign up Notifications Notifications: Notifications Fork: 8.8k Star: 16.2k Code Browsing Code: Code Issues: Issues 2.1k Pull Requests: Pull requests 1.8k Discussions: Discussions Actions: Actions Projects: Projects Wiki: Wiki Security and Quality: Security and quality 199 Insights: Insights File Browsing Browse Files: Browse files Code Search Search Code: Search within code Comments Comments: Comments Sign In to Comment: Please sign in to comment File List Filter Files: Filter files... subsys/net/lib/ptp: subsys/net/lib/ptp msg.c: msg.c Code Snippet Code Lines: 402-405 Code Content: Line Numbers Line Number: 402-405 Code Coloring Green Background: Indicates added or modified code Blue Background: Indicates unmodified code Code Icons Copy Icon: Used to copy code Share Icon: Used to share code Code Comments Comments: Comments in the code explain the reason and purpose of the fix Code Errors Error Log: LOG_ERR("Received message with unsupported type"); Error Return: return -EINVAL; Code Arrays Array: msg_size[] Array Size: ARRAY_SIZE(msg_size) Code Types Type: type Type Range: 0-15 Code Messages Message Type: PTP_MSG_MANAGEMENT Message Type Value: 0x0 Network Data Network Data: Message type retrieved directly from the network Out-of-Bounds Out-of-Bounds Read: out-of-bounds read Cause: Message type exceeds the array range Crash and Data Leak Crash: May cause system crash Data Leak: May cause data leak Security Security Check: Add type checking Security Fix: Prevent out-of-bounds reads Code Review Reviewer: nashif Review Time: Jun 17 Code Commit Commit Hash: 30dabd4 Committer: nashif Commit Time: Jun 17 Code Signature Signature: Anna Nashif Code Files File: subsys/net/lib/ptp/msg.c File Changes: 1 file modified Code Comments Comments: 0 comments Sign In to Comment: Please sign in to comment Code Navigation Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing Code User Actions Sign In: Sign in Sign Up: Sign up Code Notifications Notifications: Notifications Fork: 8.8k Star: 16.2k Code Code Browsing Browse Files: Browse files Code Code Search Search Code: Search within code Code Code Snippet Code Lines: 402-405 Code Content: Code Code Line Numbers Line Number: 402-405 Code Code Coloring Green Background: Indicates added or modified code Blue Background: Indicates unmodified code Code Code Icons Copy Icon: Used to copy code Share Icon: Used to share code Code Code Comments Comments: Comments in the code explain the reason and purpose of the fix Code Code Errors Error Log: LOG_ERR("Received message with unsupported type"); Error Return: return -EINVAL; Code Code Arrays Array: msg_size[] Array Size: ARRAY_SIZE(msg_size) Code Code Types Type: type Type Range: 0-15 Code Code Messages Message Type: PTP_MSG_MANAGEMENT Message Type Value: 0x0 Code Code Network Network Data: Message type retrieved directly from the network Code Code Out-of-Bounds Out-of-Bounds Read: out-of-bounds read Cause: Message type exceeds the array range Code Code Crash Crash: May cause system crash Data Leak: May cause data leak Code Code Security Security Check: Add type checking Security Fix: Prevent out-of-bounds reads Code Code Review Reviewer: nashif Review Time: Jun 17 Code Code Commit Commit Hash: 30dabd4 Committer: nashif Commit Time: Jun 17 Code Code Signature Signature: Anna Nashif Code Code Files File: subsys/net/lib/ptp/msg.c File Changes: 1 file modified Code Code Comments Comments: 0 comments Sign In to Comment: Please sign in to comment Code Code Navigation Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing Code Code User Actions Sign In: Sign in Sign Up: Sign up Code Code Notifications Notifications: Notifications Fork: 8.8k Star: 16.2k Code Code Code Browsing Browse Files: Browse files Code Code Code Search Search Code: Search within code Code Code Code Snippet Code Lines: 402-405 Code Content: Code Code Cod

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr OS PTP Out-of-Bounds Read Fix in ptp_msg_post_recv

More from this source