Security

Report a vulnerability

.github/SECURITY.md

Security Policy

Supported versions

The Zephyr project supports the following versions with security updates:

The most recent release, and the release prior to that.
Active LTS releases.

At this time, with the latest release of v4.2, the supported versions are:

v4.2: Current release
v4.1: Prior release
v3.7: Current LTS

Reporting process

Please see our Security Vulnerability Reporting page for details on the process.

The RNDIS USB device class includes a buffer overflow vulnerability
GHSA-hvfp-w4h8-gxvj published Feb 7, 2022 by ceolin

High
Buffer overflow in usb device class
GHSA-fm6v-8625-99jf published Feb 7, 2022 by ceolin

High
Buffer overflow in Zephyr USB DFU DNLOAD
GHSA-c3gr-hgvr-f363 published Oct 5, 2021 by d3zd3z

Critical
L2CAP: Information leakage in le_ecred_conn_req()
GHSA-xhg3-gvj6-4rqh published Jun 21, 2021 by d3zd3z

Moderate
L2CAP: Stack based buffer overflow in le_ecred_conn_req()
GHSA-8w87-6rfp-cfrm published Jun 21, 2021 by d3zd3z

Moderate
BT: Invalid channel map in CONNECT_IND results to Deadlock
GHSA-3c2f-w4v6-qxrp published Jun 21, 2021 by d3zd3z

Moderate
BT: Invalid interval in CONNECT_IND leads to Division by Zero
GHSA-7364-p4wc-8mj4 published Jun 21, 2021 by d3zd3z

Moderate
BT: Assertion failure on repeated LL_FEATURE_REQ
GHSA-7548-5m6f-mqv9 published Jun 21, 2021 by d3zd3z

Moderate
BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQ
GHSA-46h3-hjcq-2jjr published Jun 21, 2021 by d3zd3z

Moderate
Buffer Access with Incorrect Length Value in zephyr
GHSA-8q65-5gqf-fmw5 published Oct 5, 2021 by ceolin

High

Learn more about advisories related to zephyrproject-rtos/zephyr in the GitHub Advisory Database