Executive Summary

This vulnerability is a use-after-free issue in the Zephyr RTOS native TCP stack, specifically in the net_tcp_foreach() function. The function iterates over TCP connections using a cached pointer to the next connection. However, it temporarily releases a lock (tcp_lock) while invoking a callback for each connection. During this time, another process (tcp_conn_release()) can free the next connection in the list if its reference count drops to zero, such as when a remote peer closes or resets the connection. When the iterator advances, it may dereference this freed memory, leading to a use-after-free condition.

This can cause the system to crash (denial of service) or, if the freed memory has been reallocated, allow an attacker to influence the callback's behavior, potentially leading to information disclosure or further faults.

The issue was introduced with the modern TCP2 stack in 2020 and affects Zephyr versions from 2.5.0 up to and including 4.4.0. The fix involves holding the tcp_lock across the callback execution and moving the connection teardown inside the critical section to prevent the race condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing system crashes due to a use-after-free condition in the TCP stack, resulting in denial of service.

Additionally, if the freed memory is reallocated and controlled by an attacker, the vulnerability could allow the attacker to influence the behavior of callbacks operating on TCP connections, potentially leading to information disclosure or further faults.

The vulnerability can be triggered during normal TCP traffic, for example via the 'net conn' network shell command or when an interface goes down and net_tcp_close_all_for_iface() is called.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be triggered in production via the 'net conn' network shell command or the net_tcp_close_all_for_iface() function during interface-down events.

Using the 'net conn' command in the Zephyr network shell can help observe the TCP connections and potentially detect abnormal behavior related to this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Zephyr version 4.5.0 by ensuring the tcp_lock is held across the callback in net_tcp_foreach() and moving the connection teardown inside the critical section.

Immediate mitigation steps include upgrading Zephyr to version 4.5.0 or later where the fix is applied.

Until an upgrade is possible, avoid triggering the 'net conn' command or interface-down events that invoke net_tcp_close_all_for_iface(), as these can expose the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not impact confidentiality or integrity, but it can cause denial of service by crashing the system and potentially lead to information disclosure if memory is reallocated and influenced by an attacker.

Since the vulnerability primarily affects availability and has no direct impact on confidentiality or integrity, its effect on compliance with standards like GDPR or HIPAA—which emphasize protection of personal data confidentiality and integrity—is limited.

However, denial of service conditions could indirectly affect compliance if system availability is a regulatory requirement or if the vulnerability is exploited to disrupt services handling sensitive data.

Useful 0 Not Useful 0