Zephyr PTP OOB Read CVE-2024-13481: Details and Fix

Zephyr PTP Vulnerability Summary Vulnerability Overview Title: Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP CVE: CVE-2024-13481 Severity: 5.4 / 10 (Medium) Description: The parsing function in , when handling the management TLV, only validates that the TLV length is ≥ but fails to check if the length is ≤ . As a result, if the TLV length exceeds the MTU, it causes an out-of-bounds read of up to bytes from the receive buffer, leading to information leakage. Impact: An attacker can send a message containing a short TLV to trigger the out-of-bounds read, leaking adjacent bytes and corrupting the parsed management TIME value; there is no crash, and no remote code execution. Scope of Impact Affected Component: Affected Versions: ≥ 3.7.0 and ≤ 4.1 Fixed In: 4.5.0 (merged to main, not yet released; verify against actual release) Introduced In: Since v3.7.0 (net extended TLV includes Management TLV) Fix Details Fix Commit: (merged to main) Fix Logic: Added an upper bound check for the length before type conversion: Patch Status: - branch: PR #131969 (merged) - : PR #133353 (merged) - : PR #137240 (not merged) - : PR #137478 (not merged) POC / Exploit Code The page does not provide a standalone POC code block, but gives the locations of key evidence code: ```c // subsys/net/llp/llp.c:242-253 — PTP_MGMT_TIME reads 10-byte struct ptp_timestamp; // No upper bound length check before the fix (only checks length >= sizeof(struct ptp_timestamp)) // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // Upper bound length check added (post-fix) // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length >= 2 then uses length = dv_length - 2 // subsys/net/llp/llp.c:379-380 — Only validates length

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr PTP OOB Read CVE-2024-13481: Details and Fix

More from this source