CVE-2026-13343

{"id": "CVE-2026-13343", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13343", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T20:20:21.608785Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "4.3.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["lib/midi2/ump_stream_responder.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T16:16:55.530", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w5x-w7j4-6xxc", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.\n\nEndpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet \u2014 including the two uninitialised words \u2014 is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.\n\nEach discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.\n\nThe fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed."}, {"lang": "es", "value": "La biblioteca de respuesta de UMP Stream en lib/midi2/ump_stream_responder.c construye paquetes de respuesta en una estructura midi_ump de 16 bytes (uint32_t data[4]). Los constructores make_endpoint_info() y make_function_block_info() rellenan solo las dos primeras palabras (res.data[0] y res.data[1]) y, antes de esta correcci\u00f3n, declaraban su resultado como una variable local no inicializada (struct midi_ump res;). Las dos palabras restantes (res.data[2], res.data[3]) retienen contenido obsoleto de la pila.\n\nLas notificaciones de informaci\u00f3n de punto final y de bloque de funci\u00f3n son mensajes de UMP Stream (UMP_MT_UMP_STREAM), que tienen 4 palabras de longitud, por lo que el paquete completo de 16 bytes -incluyendo las dos palabras no inicializadas- es transmitido textualmente por cfg -> send(). El respondedor es impulsado por solicitudes de descubrimiento de punto final / descubrimiento de bloque de funci\u00f3n de UMP Stream suministradas por el atacante a trav\u00e9s de ump_stream_respond(). En el servidor Network MIDI 2.0 integrado (subsys/net/lib/midi2/netmidi2.c), estas solicitudes llegan como datagramas UDP y, con el punto final predeterminado sin autenticaci\u00f3n, un par remoto puede establecer una sesi\u00f3n y activar las respuestas; la misma biblioteca tambi\u00e9n sirve a hosts USB MIDI 2.0.\n\nCada solicitud de descubrimiento hace que el dispositivo divulgue 8 bytes de su propia memoria de pila no inicializada al par, y la solicitud es libremente repetible. Esto es una fuga de informaci\u00f3n solo de confidencialidad (la causa ra\u00edz es el uso de una variable no inicializada, CWE-457/CWE-908); las palabras filtradas podr\u00edan incluir datos residuales o valores de puntero. No hay impacto en la corrupci\u00f3n de memoria, la integridad o la disponibilidad.\n\nLa correcci\u00f3n inicializa a cero ambas estructuras de resultado (struct midi_ump res = {0};), por lo que las palabras finales se borran antes de la transmisi\u00f3n. Estos son los \u00fanicos dos constructores de respondedores que dejaron palabras finales sin establecer (send_string() ya pone a cero su b\u00fafer), por lo que la fuga est\u00e1 completamente cerrada."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}