Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

Summary

CVE	CVE-2026-13479
State	PUBLISHED
Assigner	zephyr
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-26 15:16:42 UTC
Updated	2026-08-31 23:30:49 UTC
Description	The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload. The payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.

Risk And Classification

Primary CVSS: v3.1 4.3 MEDIUM from [email protected]

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.001510000 probability, percentile 0.046000000 (date 2026-08-31)

Problem Types: CWE-125 | CWE-125 bounds

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	4.3	MEDIUM	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
3.1	[email protected]	Secondary	3.1	LOW	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
3.1	CNA	CVSS	3.1	LOW	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`

CVSS v3.1 Breakdown

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Zephyrproject	Zephyr	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Zephyrproject	Zephyr	affected 3.3.0 4.4.2 semver	Not specified

References

Reference	Source	Link	Tags
github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2m6g-p3vx-...	[email protected]	github.com	Exploit, Patch, Vendor Advisory
github.com/zephyrproject-rtos/zephyr/commit/3d578067652b12993bca13fb8e07...	[email protected]	github.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.