What is CVE-2023-0779?

CVE-2023-0779 is a medium-severity vulnerability in Zephyrproject Zephyr, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2023-05-30.

How severe is CVE-2023-0779?

Medium severity. CVSS v3 base score is 6.7 out of 10.

NULL pointer dereference in Zephyrproject Zephyr

CVE-2023-0779

At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (41.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H.

Affected products

Zephyrproject Zephyr
Zephyrproject-rtos Zephyr — versions unspecified

Weakness classification (CWE)

CWE-20 — Improper Input Validation
CWE-476 — NULL Pointer Dereference

References

vulnerabilities@zephyrproject.org (Vendor Advisory)

Frequently asked questions

What is CVE-2023-0779?: CVE-2023-0779 is a medium-severity vulnerability in Zephyrproject Zephyr, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2023-05-30.
How severe is CVE-2023-0779?: Medium severity. CVSS v3 base score is 6.7 out of 10.