CVE-2026-11809

Что произошло

The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "2.0.0",
  "lessThan": "4.3.2",
  "versionType": "semver"
}

{
  "status": "affected",
  "version": "4.4.0",
  "lessThan": "4.4.2",
  "versionType": "semver"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:12:04.887808+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-11-04T05:04:02.837754+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-11-04T05:04:02.837754+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-11-04T05:04:02.837754+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:12:04.887808+00:00"
  },
  "references": [
    "cve",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-11-04T05:04:02.837754+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 08:18
2. Данные обновлены04.11.2026, 08:04
3. Данные обновлены04.11.2026, 00:12
4. Данные обновлены03.11.2026, 00:11
5. Данные обновлены02.11.2026, 00:10
6. Данные обновлены31.10.2026, 11:57
7. Данные обновлены30.10.2026, 17:17
8. Данные обновлены29.10.2026, 11:23
9. Появились сведения об исправлении29.10.2026, 00:01

Личная заметка и статус

Другие CVE того же продукта