Vulnerability feed

Executive summary

The advisory says Zephyr's OpenThread integration shipped a publicly known default joining credential, "J01NME", that could let an unauthenticated attacker within radio range take over commissioning of an uncommissioned device. The advisory describes the consequence as a device joining an attacker-controlled network and remaining mis-provisioned until reset. The fix removes the default and requires a per-device credential, and the advisory recommends provisioning a unique credential per device from factory data. The advisory does not state a severity score.

Technical summary

This is a use of a hardcoded or publicly known default credential (CONFIG_OPENTHREAD_JOINER_PSKD defaulting to "J01NME") in the Thread commissioning handshake. The attack requires an attacker within 802.15.4 radio range of an uncommissioned device, such as one that is factory-fresh, freshly reset, or had its settings erased, and that is built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd. The attacker can run a stock commissioner with that credential, complete the DTLS-PSK handshake, and supply a malicious operational dataset. The advisory states the option is not enabled by default and no in-tree sample uses the vulnerable combination. Affected and fixed version numbers are not stated, and no CVSS score, workaround beyond overriding the PSKd, or detection guidance is stated. The fix adds a BUILD_ASSERT() requiring a 6-to-32-character PSKd when joiner autostart is enabled.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

zephyrprojectZephyrOpenThreadzephyrproject zephyrZephyrOpenThread

Executive summary

A flaw in the Zephyr device multiplexer pseudo-driver lets any thread running in user mode read and change which downstream device the multiplexer forwards to, without the access check that should apply. The advisory says an attacker could suppress console, log, or shell output, or redirect that output to a device they can observe. The advisory describes the fix as adding the missing kernel object tracking and access checks; no CVSS score or workaround is stated.

Technical summary

This is an authorization flaw (missing object permission check) in the devmux syscall verifiers in drivers/misc/devmux/devmux.c, not a memory-safety issue, because the kernel implementations validate the device pointer and selection index. The affected verifiers, z_vrfy_devmux_select_get() and z_vrfy_devmux_select_set(), forward to the kernel without k_object_access_check(), and devmux instances registered with a NULL driver API are skipped by gen_kobject_list.py, so they have no kernel object. Exploitation requires a user-mode thread, CONFIG_USERSPACE=y, the experimental CONFIG_DEVMUX=y (which depends on CONFIG_DEVICE_MUTABLE), and a zephyr,devmux devicetree node. The advisory does not state affected or fixed version numbers, and it does not state a workaround or any detection guidance. The fix adds DEVICE_API(devmux, devmux_api) instances and K_OOPS checks to both verifiers.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affects

zephyrprojectZephyrzephyrproject zephyrZephyr