Description

The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty. The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts. The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T21:17:19.223Z",
  "pubdate": "2026-08-10T21:17:19.223Z",
  "executiveSummary": "An availability vulnerability exists in the UpdateHub firmware-update agent within the probe handler function z_impl_updatehub_probe() located in subsys/mgmt/updatehub/updatehub.c. The flaw involves a null pointer dereference resulting from inadequate validation of attacker-influenceable JSON metadata received from the update server.\nThe vulnerability allows a malicious or compromised update server—or a network man-in-the-middle when DTLS is disabled—to trigger a fatal CPU fault by returning a crafted response with an empty inner object array. This forces the application to dereference a zero-initialized NULL pointer via strlen(), causing Zephyr's default error handling to halt or reset the device.\nThe impact is strictly limited to a denial of service affecting system availability. There is no risk of out-of-bounds writes, memory corruption, or information disclosure.\nExploitation requires the device to execute a routine over-the-air (OTA) probe via CoAP and process metadata from an untrusted or compromised source.",
  "technicalDetails": "The vulnerability resides in the UpdateHub firmware-update agent's probe handler, specifically within the z_impl_updatehub_probe() function implemented in subsys/mgmt/updatehub/updatehub.c. The component is responsible for parsing JSON metadata returned by the update server into a fixed two-level nested-array structure.\nThe root cause of the vulnerability is insufficient input validation following the JSON parsing stage. While the parser checks the length of the outer array (objects_len != 2), it fails to verify whether the inner object array of element [1] contains any elements before attempting to access its nested members.\nBecause the parse target structures are zero-initialized prior to parsing, returning an empty second outer object array causes the nested pointer objects[1].objects[0].objects.sha256sum to remain NULL. Subsequent logic unconditionally invokes strlen() on this NULL pointer, resulting in a read from address zero. This identical defect impacts both the 'any boards' and 'some boards' metadata layouts.\nThe attack flow begins during a routine OTA probe where the agent fetches update metadata over the CoAP protocol from the configured UpdateHub server. An attacker operating a malicious or compromised update server—or positioned as a network man-in-the-middle when DTLS is disabled—supplies a specially crafted JSON response containing an empty second outer object array.\nUpon receiving the payload, the UpdateHub agent parses the response and executes the vulnerable probe handler. The absence of validation on the inner object array allows execution to proceed to the strlen() call on the NULL pointer. Under Zephyr's default error handling mechanisms, the resulting CPU fault is treated as fatal, immediately halting or resetting the target device and inducing a remote denial of service."
}