CVE-2026-12632
Full vulnerability record from the local CVENow database.
Description
Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table. That table only defines entries up to PTP_MSG_MANAGEMENT (0xD), giving it ARRAY_SIZE == 14. Before the fix there was no upper-bound check, so the undefined types 0xE and 0xF indexed one or two int slots past the end of the array — an out-of-bounds read of adjacent read-only data. The out-of-bounds value is then reused as a length: it gates msg_size[type] > cnt, and when it is small or negative it makes cnt - msg_size[type] a large positive budget passed to msg_tlv_post_recv(), whose TLV loop then walks the message suffix past the received bytes, performing further out-of-bounds reads and in-place byte-swap writes on memory beyond the message slab. The defect is reached directly from the network: ptp_port_event_gen() in subsys/net/lib/ptp/port.c reads a PTP frame with ptp_transport_recv() and calls ptp_msg_post_recv() with the attacker-chosen type. PTP uses UDP multicast or raw Ethernet (0x88F7) and is unauthenticated, so any host on the same link can trigger the indexing on a CONFIG_PTP-enabled node with no preconditions. The reliably reproducible impact is a denial of service (fault/crash); a limited memory-corruption path exists but depends on the build-specific value adjacent to msg_size[], which the attacker cannot tune. The fix rejects type >= ARRAY_SIZE(msg_size) with -EBADMSG before any indexing.
View original CVE JSON
{
"id": "CVE-2026-12632",
"sourceIdentifier": "[email protected]",
"published": "2026-08-18T21:16:33.783",
"lastModified": "2026-10-22T22:10:00.250",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table. That table only defines entries up to PTP_MSG_MANAGEMENT (0xD), giving it ARRAY_SIZE == 14. Before the fix there was no upper-bound check, so the undefined types 0xE and 0xF indexed one or two int slots past the end of the array — an out-of-bounds read of adjacent read-only data.\n\nThe out-of-bounds value is then reused as a length: it gates msg_size[type] > cnt, and when it is small or negative it makes cnt - msg_size[type] a large positive budget passed to msg_tlv_post_recv(), whose TLV loop then walks the message suffix past the received bytes, performing further out-of-bounds reads and in-place byte-swap writes on memory beyond the message slab.\n\nThe defect is reached directly from the network: ptp_port_event_gen() in subsys/net/lib/ptp/port.c reads a PTP frame with ptp_transport_recv() and calls ptp_msg_post_recv() with the attacker-chosen type. PTP uses UDP multicast or raw Ethernet (0x88F7) and is unauthenticated, so any host on the same link can trigger the indexing on a CONFIG_PTP-enabled node with no preconditions.\n\nThe reliably reproducible impact is a denial of service (fault/crash); a limited memory-corruption path exists but depends on the build-specific value adjacent to msg_size[], which the attacker cannot tune. The fix rejects type >= ARRAY_SIZE(msg_size) with -EBADMSG before any indexing."
},
{
"lang": "es",
"value": "El gestor de recepción del Protocolo de Tiempo de Precisión de Zephyr ptp_msg_post_recv() en subsys/net/lib/ptp/msg.c toma el tipo de mensaje de 4 bits directamente del cable a través de ptp_msg_type() (msg -> header.type_major_sdo_id & 0xF, rango 0-15) y lo usa para indexar la tabla msg_size[]. Esa tabla solo define entradas hasta PTP_MSG_MANAGEMENT (0xD), dándole un ARRAY_SIZE == 14. Antes de la corrección no había una comprobación de límite superior, por lo que los tipos indefinidos 0xE y 0xF indexaban una o dos ranuras int más allá del final del array - una lectura fuera de límites de datos adyacentes de solo lectura.\n\nEl valor fuera de límites se reutiliza entonces como una longitud: controla msg_size[type] > cnt, y cuando es pequeño o negativo hace que cnt - msg_size[type] sea un gran presupuesto positivo pasado a msg_tlv_post_recv(), cuyo bucle TLV luego recorre el sufijo del mensaje más allá de los bytes recibidos, realizando lecturas fuera de límites adicionales y escrituras de intercambio de bytes in situ en la memoria más allá del bloque de mensajes.\n\nEl defecto se alcanza directamente desde la red: ptp_port_event_gen() en subsys/net/lib/ptp/port.c lee una trama PTP con ptp_transport_recv() y llama a ptp_msg_post_recv() con el tipo elegido por el atacante. PTP usa multidifusión UDP o Ethernet sin procesar (0x88F7) y no está autenticado, por lo que cualquier host en el mismo enlace puede activar la indexación en un nodo habilitado para CONFIG_PTP sin precondiciones.\n\nEl impacto reproducible de forma fiable es una denegación de servicio (fallo/bloqueo); existe una ruta de corrupción de memoria limitada pero depende del valor específico de la compilación adyacente a msg_size[], que el atacante no puede ajustar. La corrección rechaza el tipo >= ARRAY_SIZE(msg_size) con -EBADMSG antes de cualquier indexación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"subsys/net/lib/ptp/msg.c"
],
"versions": [
{
"version": "3.7.0",
"lessThan": "4.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-19T13:21:36.731868Z",
"id": "CVE-2026-12632",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/30dabd4c2f2e3641732c00111cd80b5c524c0136",
"source": "[email protected]"
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-frjr-h396-7wh4",
"source": "[email protected]"
}
]
}