Security

Report a vulnerability

.github/SECURITY.md

Security Policy

Supported versions

The Zephyr project supports the following versions with security updates:

The most recent release, and the release prior to that.
Active LTS releases.

At this time, with the latest release of v3.6, the supported versions are:

v3.7: Current LTS
v3.6: Prior release
v2.7: Prior LTS

Reporting process

Please see our Security Vulnerability Reporting page for details on the process.

Security problem with settings and littlefs
GHSA-5qhg-j6wc-4f6q published Apr 26, 2021 by d3zd3z

Low
Disconnecting L2CAP channel right after invalid ATT request leads freeze
GHSA-7g38-3x9v-v7vp published Jun 21, 2021 by d3zd3z

Moderate
Truncated L2CAP K-frame causes assertion failure
GHSA-fx88-6c29-vrp3 published Jun 21, 2021 by d3zd3z

Moderate
Incorrect Error Handling in Bluetooth HCI core
GHSA-gc66-xfrc-24qr published Apr 26, 2021 by d3zd3z

Low
Missing Size Checks in Bluetooth HCI over SPI
GHSA-hg2w-62p6-g67c published Apr 26, 2021 by d3zd3z

Low
Improper Input Frame Validation in ieee802154 Processing
GHSA-3gvq-h42f-v3c7 published Apr 26, 2021 by d3zd3z

High
FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat
GHSA-7fhv-rgxr-x56h published Apr 26, 2021 by d3zd3z

Moderate
Improper Handling of Insufficient Permissions or Privileges in zephyr
GHSA-vf79-hqwm-w4xc published Apr 26, 2021 by d3zd3z

Moderate
Zephyr Bluetooth unchecked packet data results in denial of service
GHSA-f6vh-7v4x-8fjp published Apr 26, 2021 by d3zd3z

Moderate
BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known
GHSA-j76f-35mc-4h63 published Oct 5, 2021 by ceolin

Moderate

Learn more about advisories related to zephyrproject-rtos/zephyr in the GitHub Advisory Database