There is a potential OOB Write vulnerability in the
gen_prov_start function in pb_adv.c. The full length of the received
data is copied into the link.rx.buf receiver buffer in line 673
without any validation on the data size.

Technical Details

1. There is a memcpy on line 673 that copies data into link.rx.buf->data buffer.
2. There is no validation on the length of the received data buf->len.
3. There seems to be a check on line 631. However, link.rx.buf->len is read from the packet
   (in line 618) and may not correspond to the actual length of the packet in buf->len.
4. Hence, if the source buffer has a length greater than that of the receiver buffer, a
   malicious packet can write out of bounds in this function.

Potential Impact

An out-of-bound write can lead to an arbitrary code execution. This is more severe in real-time
operating systems like Zephyr that run in embedded devices without common memory
protection systems. Even on devices with some form of memory protection, this can still lead to
a crash and a resultant denial of service.

Recommended Fix

We recommend that the validation on line 631 should be updated so it validates that the
buf->len field is not greater than the receiver buffer size.

Patches

main: #95064
4.2: #97520
4.1: #97519

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2025-11-24