Description
The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload.

The payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener.

The over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.
Published: 2026-08-26
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Integrity impact on device clock offset
Action: Patch
AI Analysis

Impact

The flaw is an out‑of‑bounds read in the LoRaWAN clock‑sync service. The command loop only checks the one‑byte command identifier, then attempts to read a 4‑byte time correction and a 1‑byte token from a payload that may be too short. The read can go up to five bytes past the end of the encrypted payload buffer. Because the buffer is a fixed 255‑byte static array, the extra bytes are harmless in terms of memory corruption, and no data is disclosed. However, if the stale token matches the stored request token, the garbage time correction can be applied to the device’s own clock offset, subtly altering the local time estimate.

Affected Systems

The vulnerability resides in Zephyr RTOS’s LoRaWAN subsystem, specifically subsys/lorawan/services/clock_sync.c. Any Zephyr build that includes the clock‑sync service and has not applied commit 3d578067652b12993bca13fb8e07dc45d062d4a5 is affected. The bug requires a valid downlink on the clock‑sync port that passes LoRaWAN MAC integrity and frame‑payload decryption, so the attacker must be a legitimate network or application server or possess the session keys.

Risk and Exploitability

The CVSS score of 3.1 indicates low severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting it is not yet widely exploited. Attackers need privileged server access or session keys; there is no arbitrary code execution or crash. The risk is limited to a small integrity impact on the device’s timekeeping and is confined to the victim device. Therefore, the likelihood of exploitation in the wild is low, but applying the patch removes the check entirely.

Generated by OpenCVE AI on August 26, 2026 at 16:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that adds a length check for AppTimeAns (commit 3d578067652b12993bca13fb8e07dc45d062d4a5) or upgrade to a release that includes the fix.
  • Verify that only trusted network/application servers can send clock‑sync downlinks and consider disabling the clock‑sync service if it is not required.
  • Monitor the device’s time offset for unexpected changes and, if possible, implement telemetry to alert operators to anomalous time corrections.

Generated by OpenCVE AI on August 26, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload. The payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.
Title Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-26T15:44:15.133Z

Reserved: 2026-06-27T13:33:55.407Z

Link: CVE-2026-13479

cve-icon Vulnrichment

Updated: 2026-08-26T15:44:11.476Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-26T15:16:42.693

Modified: 2026-08-31T23:30:49.027

Link: CVE-2026-13479

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T19:30:05Z

Weaknesses