Description
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and never fails on a missing one — so a response that omits the "sha256sum" string leaves the corresponding const char * in the zero-initialised struct resp_probe_any_boards / struct resp_probe_some_boards at NULL. Both metadata branches then computed sha256size = strlen(...objects.sha256sum) + 1 before any validation, dereferencing that NULL pointer; the SHA256_HEX_DIGEST_SIZE test that follows operates on a value the bad read has already produced and cannot prevent it.

The metadata is supplied entirely by the network peer: probe_cb() accepts the datagram, runs coap_packet_parse() and copies the payload with no token matching and no cryptographic check. With CONFIG_UPDATEHUB_DTLS unset — the default — start_coap_client() uses plain CoAP over UDP on port 5683 with no peer authentication and resolves the server via unauthenticated DNS, so an on-path attacker, a DNS spoofer, or an off-path attacker who wins the race with a forged source address can deliver the malformed metadata. A probe response as simple as "objects":[[{}],[{}]] suffices, and no user interaction is required because updatehub_autohandler() polls on CONFIG_UPDATEHUB_POLL_INTERVAL. When CONFIG_UPDATEHUB_DTLS=y the trigger narrows to a malicious or compromised update server.

The primitive is a read at address zero, not a write, so the impact is availability only. On targets where the low address range is unmapped or protected — MMU-based architectures, builds with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP, TrustZone non-secure images, and SoCs such as nRF54L whose 0x0–0x400 window is unmapped — the load faults and Zephyr's default fatal handler halts the system, giving a remotely re-triggerable denial of service on every poll. On classic Cortex-M targets where the vector table is readable at address zero the walk usually terminates immediately and the request is rejected by the length check, so the outcome is configuration- and SoC-dependent. There is no memory write, and the copied bytes are only compared against the locally computed image hash, so there is no information-disclosure channel.

The fix adds an explicit sha256sum == NULL test that returns UPDATEHUB_METADATA_ERROR ahead of the strlen() in both metadata branches. Debug builds (CONFIG_UPDATEHUB_LOG_LEVEL=4) still format the same pointers with %s in a LOG_DBG() loop that runs before the new checks, so that variant remains in debug configurations only.
Published: 2026-10-19
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Availability (Denial of Service) via NULL pointer dereference
Action: Patch
AI Analysis

Impact

A bug in Zephyr's UpdateHub firmware‑over‑the‑air client causes a NULL pointer dereference when the "sha256sum" field of a CoAP probe response is omitted. The code calculates the size of the SHA‑256 digest using strlen() before validating that the string is present, which triggers a read at address zero. The resultant fault halts the system only on architectures that map or protect the low memory region; thus the impact is limited to availability and is not exploitable for data disclosure or code execution.

Affected Systems

The affected product is Zephyr Real‑Time Operating System. The vulnerability is present in builds that compile UpdateHub with CONFIG_UPDATEHUB enabled and, by default, with DTLS disabled. The issue applies to any target that includes the UpdateHub client, including Cortex‑M microcontrollers, nRF54L devices, and other SoCs that do not provide a null‑pointer fault guard. Clients running Zephyr with DTLS enabled or those that exclude UpdateHub from the build are not affected.

Risk and Exploitability

The CVSS score is 5.9, indicating a medium severity. No EPSS score is provided, so the likelihood of exploitation cannot be determined from the available data. The vulnerability can be triggered remotely by any entity able to send a malformed CoAP probe response to the device, such as an on‑path network attacker, a DNS spoofer, or an off‑path attacker who outpaces a legitimate source. The impact is strictly availability; the attacker can repeatedly re‑trigger the fault on each automatic polling interval if the firmware is not updated or hardened.

Generated by OpenCVE AI on October 20, 2026 at 11:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that adds a check for a NULL sha256sum before calling strlen(). This patch is available in the commit 6fc4f27a and the related GitHub advisory GHSA-82gq-cmqw-xgx2.
  • Enable DTLS for updatehub traffic (CONFIG_UPDATEHUB_DTLS=y) or otherwise enforce CoAP authentication so that only a trusted update server can send metadata. This reduces the attack surface to a compromised or malicious update server.
  • If a patch cannot be applied immediately, consider disabling updatehub auto‑polling (reduce CONFIG_UPDATEHUB_POLL_INTERVAL) or blocking outbound CoAP traffic on UDP port 5683 to prevent the adversary from delivering malformed probes.

Generated by OpenCVE AI on October 20, 2026 at 11:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 19 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and never fails on a missing one — so a response that omits the "sha256sum" string leaves the corresponding const char * in the zero-initialised struct resp_probe_any_boards / struct resp_probe_some_boards at NULL. Both metadata branches then computed sha256size = strlen(...objects.sha256sum) + 1 before any validation, dereferencing that NULL pointer; the SHA256_HEX_DIGEST_SIZE test that follows operates on a value the bad read has already produced and cannot prevent it. The metadata is supplied entirely by the network peer: probe_cb() accepts the datagram, runs coap_packet_parse() and copies the payload with no token matching and no cryptographic check. With CONFIG_UPDATEHUB_DTLS unset — the default — start_coap_client() uses plain CoAP over UDP on port 5683 with no peer authentication and resolves the server via unauthenticated DNS, so an on-path attacker, a DNS spoofer, or an off-path attacker who wins the race with a forged source address can deliver the malformed metadata. A probe response as simple as "objects":[[{}],[{}]] suffices, and no user interaction is required because updatehub_autohandler() polls on CONFIG_UPDATEHUB_POLL_INTERVAL. When CONFIG_UPDATEHUB_DTLS=y the trigger narrows to a malicious or compromised update server. The primitive is a read at address zero, not a write, so the impact is availability only. On targets where the low address range is unmapped or protected — MMU-based architectures, builds with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP, TrustZone non-secure images, and SoCs such as nRF54L whose 0x0–0x400 window is unmapped — the load faults and Zephyr's default fatal handler halts the system, giving a remotely re-triggerable denial of service on every poll. On classic Cortex-M targets where the vector table is readable at address zero the walk usually terminates immediately and the request is rejected by the length check, so the outcome is configuration- and SoC-dependent. There is no memory write, and the copied bytes are only compared against the locally computed image hash, so there is no information-disclosure channel. The fix adds an explicit sha256sum == NULL test that returns UPDATEHUB_METADATA_ERROR ahead of the strlen() in both metadata branches. Debug builds (CONFIG_UPDATEHUB_LOG_LEVEL=4) still format the same pointers with %s in a LOG_DBG() loop that runs before the new checks, so that variant remains in debug configurations only.
Title NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-04T05:01:11.074Z

Reserved: 2026-08-19T17:53:24.899Z

Link: CVE-2026-76787

cve-icon Vulnrichment

Updated: 2026-10-20T18:07:50.690Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T21:18:01.230

Modified: 2026-11-04T05:19:00.983

Link: CVE-2026-76787

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T11:45:14Z

Weaknesses