Description

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T23:16:27.870Z",
  "pubdate": "2026-09-13T23:16:27.870Z",
  "executiveSummary": "A critical vulnerability exists in the Zephyr RTOS MQTT-SN client implementation within the `process_ping()` function of `subsys/net/lib/mqtt_sn/mqtt_sn.c`.\nThe vulnerability is identified as a NULL pointer dereference resulting from incorrect macro usage when managing gateway records.\nAn unauthenticated, remote attacker can trigger a denial-of-service (DoS) condition by forcing the MQTT-SN client to exhaust PINGREQ retries, leading to a kernel panic or silent memory allocator corruption.\nThe flaw stems from the failure to correctly assign the result of `SYS_SLIST_PEEK_HEAD_CONTAINER` to the `gw` pointer, causing the code to perform operations on a NULL reference.\nThis vulnerability is remotely triggerable over UDP, as the MQTT-SN protocol does not require authentication, allowing an attacker to manipulate the client's connection state to reach the vulnerable code path.\nRisk implications include potential system-wide instability or silent memory corruption, which may facilitate further exploitation depending on the underlying hardware architecture and memory mapping.",
  "technicalDetails": "The vulnerability resides in the keepalive handler `process_ping()` within `subsys/net/lib/mqtt_sn/mqtt_sn.c`. When the client exceeds the configured number of PINGREQ retries, it attempts to remove the associated gateway record from the internal list.\nThe root cause is a misuse of the `SYS_SLIST_PEEK_HEAD_CONTAINER` macro. The code invokes this macro but fails to assign the resulting pointer to the `gw` variable. Because the macro acts as a pure expression, the `gw` variable retains its initial NULL value regardless of the contents of the `client->gateways` list.\nSubsequently, the function dereferences this NULL `gw` pointer to access `gw->gw_id` and passes the resulting NULL reference to `mqtt_sn_gw_destroy()`. This function eventually invokes `k_mem_slab_free(&gateways, NULL)`.\nIf `CONFIG_MEM_SLAB_POINTER_VALIDATE` is enabled, the kernel detects the invalid pointer and triggers a `k_panic()`, resulting in an immediate denial-of-service. In configurations where this validation is disabled, the kernel performs a write operation through the NULL pointer—specifically attempting to update the slab's free list at address 0. On architectures where address 0 is writable, this leads to silent corruption of the memory allocator, which can cause unpredictable system behavior and secondary security failures.\nThe attack flow requires an attacker to interact with the MQTT-SN client over UDP. Since MQTT-SN lacks inherent authentication, an attacker can position themselves as a rogue gateway or intercept traffic to blackhole PINGRESP packets, forcing the client to reach the retry threshold. Once the retries are exhausted, the client autonomously enters the vulnerable code branch.\nThis behavior is limited to the keepalive handler, as the `process_advertise()` function correctly utilizes `SYS_SLIST_FOR_EACH_CONTAINER_SAFE` for list traversal, avoiding this specific memory management flaw. Exploitation does not involve arbitrary data injection but serves as a stable vector for achieving service availability loss through state manipulation."
}