Description

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-10T21:17:18.190Z",
  "pubdate": "2026-08-10T21:17:18.190Z",
  "executiveSummary": "A vulnerability exists in the UpdateHub OTA client affecting the subsys/mgmt/updatehub/updatehub.c file within the z_impl_updatehub_probe() function. The flaw is categorized as an out-of-bounds and uninitialized-memory read vulnerability leading to a network-triggerable denial of service.\nThe vulnerability arises when a server response is copied into a dynamically allocated buffer without proper NUL-termination, causing a subsequent strlen() operation to read past the buffer boundary into uninitialized heap memory during JSON parsing failure fallbacks.\nThe affected product is UpdateHub OTA client. An attacker operating a malicious, compromised, or on-path UpdateHub server can exploit this issue by supplying a crafted probe payload that triggers a parsing failure and subsequent over-read. Without the optional CONFIG_UPDATEHUB_DTLS configuration, this exposure increases for on-path network adversaries.\nThe primary risk implication is a thread or device crash resulting in denial of service due to memory access faults. There is no direct information disclosure or out-of-bounds write capability, as the over-read data is consumed internally and never returned to the attacker.",
  "technicalDetails": "The vulnerability resides in the subsys/mgmt/updatehub/updatehub.c file specifically within the z_impl_updatehub_probe() function of the UpdateHub OTA client. The root cause is improper handling of string termination when copying untrusted server probe responses into dynamically allocated heap memory.\nDuring execution, the probe response received from the UpdateHub server is initially copied into a correctly NUL-terminated metadata heap buffer. Subsequently, a second buffer named metadata_copy is allocated using k_malloc, which does not zero-initialize the allocated memory. The content of the metadata buffer is then transferred to metadata_copy using memcpy(metadata_copy, metadata, strlen(metadata)). This copy operation omits the terminating NUL byte, leaving any bytes following the copied content in the allocation as uninitialized heap data.\nThe attack flow proceeds when the initial json_obj_parse() call over the array descriptor fails. Upon failure, the application attempts a fallback parsing mechanism via json_obj_parse(metadata_copy, strlen(metadata_copy), ...). Because metadata_copy lacks a terminating NUL byte, the strlen() function scans past the legitimately copied bytes and reads through the uninitialized heap. If no zero byte is encountered before the end of the heap allocation, the function reads beyond the buffer boundary, and the resulting over-long length is subsequently processed as part of the JSON parsing routine.\nThe attack vector requires a malicious, compromised, or on-path UpdateHub server capable of intercepting or generating responses, as the probe payload is fully controlled by the server. The optional CONFIG_UPDATEHUB_DTLS mitigation may not be enabled, increasing susceptibility to on-path manipulation. The attacker crafts a payload designed to fail the initial parsing phase, thereby driving the execution flow into the vulnerable fallback code path.\nThe post-exploitation impact is limited to a denial of service. The over-read data is consumed exclusively for evaluating the software update internally and is never returned to the attacker, precluding information disclosure. However, reading past the metadata_copy allocation triggers an out-of-bounds memory read that can fault and crash the update thread or the entire device."
}