CVE-2026-76787 in Zephyr
Summary
by MITRE • 10/19/2026
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and never fails on a missing one — so a response that omits the "sha256sum" string leaves the corresponding const char * in the zero-initialised struct resp_probe_any_boards / struct resp_probe_some_boards at NULL. Both metadata branches then computed sha256size = strlen(...objects.sha256sum) + 1 before any validation, dereferencing that NULL pointer; the SHA256_HEX_DIGEST_SIZE test that follows operates on a value the bad read has already produced and cannot prevent it.
The metadata is supplied entirely by the network peer: probe_cb() accepts the datagram, runs coap_packet_parse() and copies the payload with no token matching and no cryptographic check. With CONFIG_UPDATEHUB_DTLS unset — the default — start_coap_client() uses plain CoAP over UDP on port 5683 with no peer authentication and resolves the server via unauthenticated DNS, so an on-path attacker, a DNS spoofer, or an off-path attacker who wins the race with a forged source address can deliver the malformed metadata. A probe response as simple as "objects":[[{}],[{}]] suffices, and no user interaction is required because updatehub_autohandler() polls on CONFIG_UPDATEHUB_POLL_INTERVAL. When CONFIG_UPDATEHUB_DTLS=y the trigger narrows to a malicious or compromised update server.
The primitive is a read at address zero, not a write, so the impact is availability only. On targets where the low address range is unmapped or protected — MMU-based architectures, builds with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP, TrustZone non-secure images, and SoCs such as nRF54L whose 0x0–0x400 window is unmapped — the load faults and Zephyr's default fatal handler halts the system, giving a remotely re-triggerable denial of service on every poll. On classic Cortex-M targets where the vector table is readable at address zero the walk usually terminates immediately and the request is rejected by the length check, so the outcome is configuration- and SoC-dependent. There is no memory write, and the copied bytes are only compared against the locally computed image hash, so there is no information-disclosure channel.
The fix adds an explicit sha256sum == NULL test that returns UPDATEHUB_METADATA_ERROR ahead of the strlen() in both metadata branches. Debug builds (CONFIG_UPDATEHUB_LOG_LEVEL=4) still format the same pointers with %s in a LOG_DBG() loop that runs before the new checks, so that variant remains in debug configurations only.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified as CVE-2024-XXXX involves a null pointer dereference within the UpdateHub firmware-over-the-air client for Zephyr RTOS, specifically located in the z_impl_updatehub_probe function found in subsys/mgmt/updatehub/updatehub.c. This flaw arises from how the CoAP probe response is parsed using Zephyr's JSON library. The json_obj_parse function returns a bitmask indicating which fields were successfully decoded and does not fail if optional fields are missing. Consequently, when a server omits the sha256sum field in its response, the corresponding pointer within the resp_probe_any_boards or resp_probe_some_boards structures remains NULL due to zero-initialization. The code subsequently attempts to calculate the length of this string using strlen before performing any validation checks. Since strlen operates on an invalid address when passed a null pointer, it triggers undefined behavior that typically manifests as a crash in embedded environments where low memory addresses are unmapped or protected.
The operational impact is primarily a denial of service, classified under CWE-476: NULL Pointer Dereference. Because the primitive involves reading from address zero rather than writing to arbitrary memory locations, there is no direct risk of code execution or information disclosure through this specific path. The copied bytes are only compared against locally computed image hashes, preventing an attacker from exfiltrating sensitive data via this vector. However, on MMU-based architectures and systems with null pointer exception detection features such as CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT, MPU, PMP, TrustZone non-secure images, or SoCs like the nRF54L where the 0x0–0x400 window is unmapped, this dereference results in a fatal fault. Zephyr's default fatal handler then halts the system, effectively causing a remote denial of service that can be re-triggered on every polling interval defined by CONFIG_UPDATEHUB_POLL_INTERVAL. On classic Cortex-M targets where the vector table resides at address zero and is readable, the behavior may vary, potentially terminating immediately or being caught by subsequent length checks, making the exploitability dependent on specific hardware configurations and build settings.
The attack surface for this vulnerability is significant due to the network-facing nature of the CoAP client. The metadata is supplied entirely by a network peer through probe_cb(), which accepts datagrams via coap_packet_parse() without token matching or cryptographic verification when DTLS is disabled, which is the default configuration with CONFIG_UPDATEHUB_DTLS unset. In this state, communication occurs over plain CoAP UDP on port 5683 with no peer authentication and unauthenticated DNS resolution for server addresses. This allows an on-path attacker, a DNS spoofer, or even an off-path attacker who can forge source IP addresses to deliver malformed metadata containing objects without the sha256sum field. A minimal payload such as "objects":[[{}],[{}]] is sufficient to trigger the flaw. No user interaction is required because the updatehub_autohandler automatically polls for updates based on configured intervals. If DTLS is enabled, the threat model narrows significantly to require a malicious or compromised update server capable of providing valid cryptographic signatures but malformed JSON content.
Mitigation strategies involve both immediate patching and architectural hardening. The primary fix involves adding an explicit check for sha256sum == NULL before calling strlen in both metadata branches, returning UPDATEHUB_METADATA_ERROR if the field is missing. This prevents the invalid memory access entirely. Administrators should ensure that CONFIG_UPDATEHUB_DTLS is enabled to enforce peer authentication and encryption, thereby restricting potential attackers to trusted entities only. Additionally, enabling null pointer exception detection features such as CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT can help in detecting these faults during development or testing phases, although it does not prevent the initial trigger if DTLS is disabled. It is also important to note that debug builds with LOG_LEVEL set to 4 may still format pointers using %s before the new checks are applied, so this variant remains a risk only in debug configurations and should be excluded from production deployments. Aligning with ATT&CK techniques such as T1498 Network Denial of Service or T1078 Valid Accounts if server compromise is involved helps in monitoring for anomalous update requests that deviate from expected metadata structures.