CVE-2025-1673
📋 TL;DR
CVE-2025-1673 is an out-of-bounds read vulnerability in Zephyr RTOS DNS handling that allows a malicious DNS packet without payload to cause denial of service or incorrect computation. This affects systems running Zephyr RTOS with DNS functionality enabled, primarily IoT and embedded devices.
💻 Affected Systems
- Zephyr RTOS
📦 What is this software?
Zephyr by Zephyrproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the out-of-bounds read can be leveraged for memory corruption attacks.
Likely Case
Denial of service through system crash or reboot, disrupting device functionality.
If Mitigated
Limited impact with proper network segmentation and DNS filtering in place.
🎯 Exploit Status
Exploitation requires sending specially crafted DNS packets to vulnerable systems. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zephyr v3.7.0 and later
Vendor Advisory: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jjhx-rrh4-j8mx
Restart Required: Yes
Instructions:
1. Update Zephyr RTOS to version 3.7.0 or later. 2. Rebuild and redeploy firmware to affected devices. 3. Verify DNS functionality works correctly after update.
🔧 Temporary Workarounds
Disable DNS functionality
allTemporarily disable DNS resolution if not required for device operation
CONFIG_DNS_RESOLVER=n in project configuration
Network filtering
allBlock or filter DNS packets at network perimeter
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable devices
- Deploy DNS filtering/proxy to sanitize DNS traffic before reaching vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check Zephyr version: if running version < 3.7.0 and DNS is enabled, system is vulnerableCheck Version:
Check Zephyr version in build configuration or device firmware informationVerify Fix Applied:
Verify Zephyr version is 3.7.0 or later and test DNS functionality📡 Detection & Monitoring
Log Indicators:
- System crashes or reboots following DNS queries
- DNS parsing errors in system logs
Network Indicators:
- Malformed DNS packets with missing payloads
- DNS traffic causing device instability
SIEM Query:
DNS packets with malformed structure OR device_crash after dns_query