CVE-2023-5184

Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver

State: Published
Severity: 7.0 High
Published: Sep 27, 2023
Updated: Jun 18, 2025
Reserved: Sep 25, 2023

Description

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H	zephyr

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-195 Signed to Unsigned Conversion Error

Affected Products

Product	Versions
Zephyrzephyrproject-rtos	3.4 and earlierAffected

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8x3p-q3r5-xh9g
http://www.openwall.com/lists/oss-security/2023/11/07/1
http://seclists.org/fulldisclosure/2023/Nov/1
http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.