Description

The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret > 0 flag, but ret was set to -1 immediately after the socket was created, so when zsock_setsockopt() (DTLS) or zsock_connect() subsequently failed the gate was false and cleanup_connection() was never called. The open descriptor in the global ctx.sock was then overwritten by the next attempt, permanently leaking it from the socket / net_context pool until reboot. The failing setup path is reached every time the OTA client tries to contact the UpdateHub server and the connection cannot be established — driven automatically by the periodic autohandler() poll (and on demand via the updatehub_probe()/updatehub_update() API or the updatehub run shell command). The DTLS handshake/connect outcome is influenceable by a network or on-path attacker who drops, resets, or otherwise disrupts traffic to the server, and also fails naturally whenever the server is unreachable. Each failed attempt permanently leaks one descriptor; once the shared socket pool is exhausted, networking degrades device-wide until the device is rebooted, a denial-of-service condition. Severity is low because the leak rate is bounded by the configured OTA poll interval (default once per 24 hours), the effect is gradual and recovered by reboot, and only builds with the UpdateHub client enabled are affected. There is no memory-corruption, information-disclosure, or authentication impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-10T23:16:50.893Z",
  "pubdate": "2026-08-10T23:16:50.893Z",
  "executiveSummary": "An unauthenticated resource management vulnerability exists within the UpdateHub over-the-air update client, specifically in the start_coap_client() function located in subsys/mgmt/updatehub/updatehub.c. The vulnerability involves a socket descriptor leak during CoAP and DTLS connection-setup failure paths. When connection attempts fail due to network disruptions or unreachable servers, the shared error-cleanup logic fails to invoke cleanup_connection(), causing the active socket descriptor stored in the global ctx.sock to be orphaned and subsequently overwritten.\nThe impact of this vulnerability is a persistent denial-of-service condition affecting the entire device. Each failed connection attempt permanently leaks a single socket and net_context descriptor until pool exhaustion occurs, leading to device-wide networking degradation until reboot. An on-path or network attacker can accelerate this degradation by deliberately disrupting, dropping, or resetting traffic directed to the UpdateHub server. Alternatively, natural network failures will trigger the leak automatically via the periodic autohandler() poll, the updatehub_probe() and updatehub_update() APIs, or the updatehub run shell command.\nThe severity is evaluated as low because the leak rate is bounded by the configured OTA poll interval, the system recovers upon reboot, and exploitation is restricted to builds where the UpdateHub client is explicitly enabled. There are no memory-corruption, information-disclosure, or authentication-bypass impacts associated with this vulnerability.",
  "technicalDetails": "The vulnerability resides in the start_coap_client() function within subsys/mgmt/updatehub/updatehub.c in the UpdateHub over-the-air update client subsystem. The root cause of the socket leak stems from flawed error-handling logic designed to trigger resource cleanup upon connection setup failures.\nDuring the initialization of the CoAP client, a socket is created and its return status is tracked via a local variable. Immediately after socket creation, the return status variable ret is explicitly set to -1. Consequently, when subsequent configuration functions such as zsock_setsockopt() for DTLS or zsock_connect() fail, the conditional gate checking if ret > 0 evaluates to false. This prevents the execution of cleanup_connection(), leaving the underlying socket descriptor open.\nWhen the socket descriptor remains open and cleanup_connection() is bypassed, the open descriptor reference stored in the global variable ctx.sock is overwritten by subsequent connection attempts. This orphans the original descriptor, permanently leaking it from the underlying socket and net_context pool for the lifetime of the running system, or until the device is rebooted.\nThe attack flow proceeds as follows: First, the OTA client initiates a connection attempt to the UpdateHub server, either automatically via the periodic autohandler() poll, on-demand through the updatehub_probe() or updatehub_update() APIs, or manually via the updatehub run shell command. Second, an on-path or network attacker disrupts the network path by dropping, resetting, or otherwise interfering with the CoAP or DTLS handshake traffic. Alternatively, natural network unreachability causes the connection attempt to fail. Third, the failure path executes, hitting the flawed conditional check where ret is set to -1, which bypasses the cleanup logic. Fourth, the socket descriptor is leaked and orphaned in memory. Finally, repeated execution of this sequence exhausts the shared net_context and socket pools, resulting in a system-wide denial of service.\nThe vulnerable component is the UpdateHub over-the-air update client connection management implementation. The vulnerability requires no authentication or privileges, but depends on network exposure to the UpdateHub server infrastructure or the presence of an active on-path attacker capable of manipulating network packets during the handshake phase."
}