FKIE_CVE-2026-2411
Vulnerability from fkie_nvd - Published: 2026-08-01 13:16 - Updated: 2026-10-23 23:10
Severity
Summary
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).
When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.
A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.
The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zephyrproject | zephyr | * |
{
"affected": [
{
"affectedData": [
{
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"defaultStatus": "unaffected",
"packageName": "zephyr",
"product": "zephyr",
"programFiles": [
"subsys/bluetooth/host/gatt.c"
],
"vendor": "zephyrproject",
"versions": [
{
"lessThan": "4.3.1",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.2",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "vulnerabilities@zephyrproject.org"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "20060992-9413-4D30-A6CD-598A9F4576E9",
"versionEndExcluding": "4.5.0",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zephyr\u0027s Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params-\u003eattr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).\n\nWhen the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params-\u003eattr pointing at the declaration, so the security check evaluated the declaration\u0027s permissions (no security required) instead of the value\u0027s. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.\n\nA remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.\n\nThe fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced."
},
{
"lang": "es",
"value": "El host Bluetooth de Zephyr declara una caracter\u00edstica GATT como dos atributos consecutivos: una Declaraci\u00f3n de Caracter\u00edstica cuyo permiso est\u00e1 codificado de forma r\u00edgida a BT_GATT_PERM_READ, y un atributo de Valor de Caracter\u00edstica que lleva los permisos de seguridad especificados por la aplicaci\u00f3n (por ejemplo, BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). Las API p\u00fablicas de notificaci\u00f3n e indicaci\u00f3n aceptan expl\u00edcitamente cualquiera de los dos atributos, y pasar la declaraci\u00f3n es el modismo documentado y com\u00fan. Antes de enviar cada notificaci\u00f3n o indicaci\u00f3n, el host vuelve a verificar la seguridad del enlace con bt_gatt_check_perm() contra params -\u003e attr en gatt_notify(), gatt_indicate(), y gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).\n\nCuando la aplicaci\u00f3n pas\u00f3 el atributo de Declaraci\u00f3n de Caracter\u00edstica, el host redirigi\u00f3 correctamente el manejador de valor pero dej\u00f3 params -\u003e attr apuntando a la declaraci\u00f3n, por lo que la verificaci\u00f3n de seguridad evalu\u00f3 los permisos de la declaraci\u00f3n (no se requer\u00eda seguridad) en lugar de los del valor. Como resultado, el requisito de cifrado/autenticaci\u00f3n/LESC configurado en el valor de la caracter\u00edstica fue omitido. La ruta de Notificaci\u00f3n M\u00faltiple adicionalmente us\u00f3 una m\u00e1scara que omit\u00eda el requisito de Conexiones Seguras LE.\n\nUn par remoto desencadena la revelaci\u00f3n al conectarse (opcionalmente sin emparejamiento o cifrado) y escribir el descriptor de Configuraci\u00f3n de Caracter\u00edstica del Cliente para habilitar notificaciones o indicaciones, haciendo que el servidor emita el valor protegido a trav\u00e9s de un enlace que no ha alcanzado el nivel de seguridad requerido. El impacto es revelaci\u00f3n de informaci\u00f3n / bypass de control de acceso para valores de caracter\u00edsticas que la aplicaci\u00f3n pretend\u00eda exponer solo a trav\u00e9s de un enlace seguro; la exposici\u00f3n depende de que la aplicaci\u00f3n declare caracter\u00edsticas de notificaci\u00f3n/indicaci\u00f3n que requieran cifrado/autenticaci\u00f3n y de que el CCC sea escribible en un nivel de seguridad inferior. No hay impacto en la seguridad de la memoria o la disponibilidad.\n\nLa soluci\u00f3n a\u00f1ade bt_gatt_attr_resolve_value(), que mapea un atributo de declaraci\u00f3n al siguiente atributo de valor antes de la verificaci\u00f3n de permisos, y cambia la ruta de Notificaci\u00f3n M\u00faltiple a la m\u00e1scara completa BT_GATT_PERM_READ_ENCRYPT_MASK para que el requisito de LESC tambi\u00e9n se aplique."
}
],
"id": "CVE-2026-2411",
"lastModified": "2026-10-23T23:10:00.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "vulnerabilities@zephyrproject.org",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-2411",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:51:21.391345Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-01T13:16:57.160",
"references": [
{
"source": "vulnerabilities@zephyrproject.org",
"tags": [
"Patch"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546"
},
{
"source": "vulnerabilities@zephyrproject.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w3r-v9q9-4462"
}
],
"sourceIdentifier": "vulnerabilities@zephyrproject.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "vulnerabilities@zephyrproject.org",
"type": "Secondary"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.