CVE-2026-12632

{"id": "CVE-2026-12632", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12632", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T13:21:36.731868Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.7.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/net/lib/ptp/msg.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T21:16:33.783", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/30dabd4c2f2e3641732c00111cd80b5c524c0136", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-frjr-h396-7wh4", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table. That table only defines entries up to PTP_MSG_MANAGEMENT (0xD), giving it ARRAY_SIZE == 14. Before the fix there was no upper-bound check, so the undefined types 0xE and 0xF indexed one or two int slots past the end of the array \u2014 an out-of-bounds read of adjacent read-only data.\n\nThe out-of-bounds value is then reused as a length: it gates msg_size[type] > cnt, and when it is small or negative it makes cnt - msg_size[type] a large positive budget passed to msg_tlv_post_recv(), whose TLV loop then walks the message suffix past the received bytes, performing further out-of-bounds reads and in-place byte-swap writes on memory beyond the message slab.\n\nThe defect is reached directly from the network: ptp_port_event_gen() in subsys/net/lib/ptp/port.c reads a PTP frame with ptp_transport_recv() and calls ptp_msg_post_recv() with the attacker-chosen type. PTP uses UDP multicast or raw Ethernet (0x88F7) and is unauthenticated, so any host on the same link can trigger the indexing on a CONFIG_PTP-enabled node with no preconditions.\n\nThe reliably reproducible impact is a denial of service (fault/crash); a limited memory-corruption path exists but depends on the build-specific value adjacent to msg_size[], which the attacker cannot tune. The fix rejects type >= ARRAY_SIZE(msg_size) with -EBADMSG before any indexing."}, {"lang": "es", "value": "El gestor de recepci\u00f3n del Protocolo de Tiempo de Precisi\u00f3n de Zephyr ptp_msg_post_recv() en subsys/net/lib/ptp/msg.c toma el tipo de mensaje de 4 bits directamente del cable a trav\u00e9s de ptp_msg_type() (msg -> header.type_major_sdo_id & 0xF, rango 0-15) y lo usa para indexar la tabla msg_size[]. Esa tabla solo define entradas hasta PTP_MSG_MANAGEMENT (0xD), d\u00e1ndole un ARRAY_SIZE == 14. Antes de la correcci\u00f3n no hab\u00eda una comprobaci\u00f3n de l\u00edmite superior, por lo que los tipos indefinidos 0xE y 0xF indexaban una o dos ranuras int m\u00e1s all\u00e1 del final del array - una lectura fuera de l\u00edmites de datos adyacentes de solo lectura.\n\nEl valor fuera de l\u00edmites se reutiliza entonces como una longitud: controla msg_size[type] > cnt, y cuando es peque\u00f1o o negativo hace que cnt - msg_size[type] sea un gran presupuesto positivo pasado a msg_tlv_post_recv(), cuyo bucle TLV luego recorre el sufijo del mensaje m\u00e1s all\u00e1 de los bytes recibidos, realizando lecturas fuera de l\u00edmites adicionales y escrituras de intercambio de bytes in situ en la memoria m\u00e1s all\u00e1 del bloque de mensajes.\n\nEl defecto se alcanza directamente desde la red: ptp_port_event_gen() en subsys/net/lib/ptp/port.c lee una trama PTP con ptp_transport_recv() y llama a ptp_msg_post_recv() con el tipo elegido por el atacante. PTP usa multidifusi\u00f3n UDP o Ethernet sin procesar (0x88F7) y no est\u00e1 autenticado, por lo que cualquier host en el mismo enlace puede activar la indexaci\u00f3n en un nodo habilitado para CONFIG_PTP sin precondiciones.\n\nEl impacto reproducible de forma fiable es una denegaci\u00f3n de servicio (fallo/bloqueo); existe una ruta de corrupci\u00f3n de memoria limitada pero depende del valor espec\u00edfico de la compilaci\u00f3n adyacente a msg_size[], que el atacante no puede ajustar. La correcci\u00f3n rechaza el tipo >= ARRAY_SIZE(msg_size) con -EBADMSG antes de cualquier indexaci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}