Description
bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compiles out when CONFIG_ASSERT is disabled, the production default), a record of exactly three bytes (0x09 followed by a 2-byte attribute ID) causes a one-byte read past the end of the logical buffer. The parser is reachable from inbound, remote-controlled data: a Bluetooth BR/EDR peer acting as an SDP server returns discovery-response records that are stored verbatim in the client receive buffer and parsed via the public bt_sdp_get_attr()/bt_sdp_has_attr()/bt_sdp_record_parse() helpers. The over-read is bounded to a single byte that is used only as an internal length selector and is never leaked to the attacker; subsequent length checks then reject the malformed record. Realistic impact is therefore limited to an edge-case denial of service (a fault only if the record ends exactly at a mapped-memory boundary, or a deterministic assert panic when CONFIG_ASSERT=y). Affects Zephyr v4.3.0 and v4.4.0; fixed by adding sizeof(type) to the length check.
Published: 2026-06-22
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malformed Bluetooth Classic Discovery Protocol (SDP) attribute can trigger an out‑of‑bounds read in Zephyr's SDP parser. The parser verifies that a buffer contains at least a type marker and a 2‑byte attribute ID, but then attempts to read a fourth byte – the data‑element descriptor – without verifying its existence. When a remote SDP server sends an attribute exactly three bytes long, the net_buf_simple_pull_u8() call dereferences a byte beyond the logical buffer, resulting in a single‑byte read past the end. The read value is used only as an internal length selector and is never supplied to the attacker, so no sensitive data is disclosed. Subsequent checks reject the malformed record, meaning the realistic impact is limited to an edge‑case denial of service: the system may crash only if the record ends exactly at a mapped‑memory boundary, or trigger an assertion panic when CONFIG_ASSERT=y.

Affected Systems

The vulnerability affects Zephyr RTOS v4.3.0 and v4.4.0; the affected code is the SDP parser in subsys/bluetooth/host/classic/sdp.c and is reachable via inbound, remote‑controlled SDP data from any Bluetooth BR/EDR peer acting as an SDP server.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate risk. The EPSS score of < 1% suggests the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. It is a remote vulnerability that requires a nearby device to initiate a Bluetooth Classic connection and transmit a specially crafted SDP attribute. Successful exploitation would cause a crash or assertion failure rather than data disclosure.

Generated by OpenCVE AI on July 29, 2026 at 23:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Zephyr operating system to a patched release that fixes the SDP parsing bug; the relevant changes are documented in the Zephyr GitHub advisory GHSA-p93g-3r68-cj53.
  • If immediate patching is not feasible, disable or drop support for Bluetooth Classic SDP in the application, or block reception of untrusted SDP packets via a firewall or custom filtering code.
  • Consider disabling assertions in builds only as a temporary measure; note that this does not eliminate the out‑of‑bounds read and may still expose memory contents, so it is not a long‑term solution.

Generated by OpenCVE AI on July 29, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-617

Tue, 14 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Description A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an additional byte for the value type without verifying that the byte is present. A truncated 3-byte attribute (for example 09 00 09) therefore reaches net_buf_simple_pull() with insufficient remaining length, triggering the __ASSERT_NO_MSG(buf->len >= len) check and a kernel panic in assert-enabled builds (denial of service). In builds where assertions are disabled, parsing may continue past the end of the available buffer, leading to an out-of-bounds read and undefined behavior. bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compiles out when CONFIG_ASSERT is disabled, the production default), a record of exactly three bytes (0x09 followed by a 2-byte attribute ID) causes a one-byte read past the end of the logical buffer. The parser is reachable from inbound, remote-controlled data: a Bluetooth BR/EDR peer acting as an SDP server returns discovery-response records that are stored verbatim in the client receive buffer and parsed via the public bt_sdp_get_attr()/bt_sdp_has_attr()/bt_sdp_record_parse() helpers. The over-read is bounded to a single byte that is used only as an internal length selector and is never leaked to the attacker; subsequent length checks then reject the malformed record. Realistic impact is therefore limited to an edge-case denial of service (a fault only if the record ends exactly at a mapped-memory boundary, or a deterministic assert panic when CONFIG_ASSERT=y). Affects Zephyr v4.3.0 and v4.4.0; fixed by adding sizeof(type) to the length check.
Title Bluetooth Classic SDP parser truncation bug in bt_sdp_parse_attribute() leads to reachable assertion and possible out-of-bounds read Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)
Weaknesses CWE-617
References

Tue, 23 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Jun 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject-rtos
Zephyrproject-rtos zephyr
Vendors & Products Zephyrproject-rtos
Zephyrproject-rtos zephyr

Tue, 23 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Description A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an additional byte for the value type without verifying that the byte is present. A truncated 3-byte attribute (for example 09 00 09) therefore reaches net_buf_simple_pull() with insufficient remaining length, triggering the __ASSERT_NO_MSG(buf->len >= len) check and a kernel panic in assert-enabled builds (denial of service). In builds where assertions are disabled, parsing may continue past the end of the available buffer, leading to an out-of-bounds read and undefined behavior.
Title Bluetooth Classic SDP parser truncation bug in bt_sdp_parse_attribute() leads to reachable assertion and possible out-of-bounds read
Weaknesses CWE-20
CWE-617
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Zephyrproject-rtos Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-17T14:54:49.238Z

Reserved: 2026-06-02T15:24:24.388Z

Link: CVE-2026-10651

cve-icon Vulnrichment

Updated: 2026-06-23T12:19:40.873Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T23:45:03Z

Weaknesses