CVE-2021-3454: zephyrproject-rtos zephyr
CVSS: 7.5v3.1HighModified
Published 19-10-2021Last modified 17-09-2024
Vulnerability summary
CVE-2021-3454 is a high (CVSS 7.5) vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.96%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 19-10-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx88-6c29-vrp3
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources2 sources · 4.3–7.5
- CVE.orgCNA4.3MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
0.96%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
0.00 pp
From 0.96% on 19-09-2026
19-09-202619-10-2026
EPSS score0.96%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Zephyrproject1 product
- zephyr≥ 2.4.0, < 2.6.0
Zephyrproject-rtos1 product
- zephyr≥ 2.4.0, < unspecified | ≥ v.2.50, < unspecified
2 vendors · 2 products
References
1 links- github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx88-6c29-vrp3X Refsource MISCPatchThird Party Advisory