CVE-2021-3319: zephyrproject-rtos zephyr NULL Pointer Dereference

Vulnerability summary

CVE-2021-3319 is a critical (CVSS 9.8) NULL Pointer Dereference vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-10-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94jg-2p6q-5364

• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
• CWE-588Attempt to Access Child of a Non-structure PointerCasting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.