{"id":"CVE-2026-13479","state":"PUBLISHED","title":"Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler","description":"The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload.\n\nThe payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener.\n\nThe over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.","publishedAt":"2026-08-26T14:03:47.708Z","updatedAt":"2026-08-26T15:44:15.133Z","severity":{"score":3.1,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"zephyr"},"assigner":"zephyr","products":["zephyrproject zephyr"],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.3.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["subsys/lorawan/services/clock_sync.c"]}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/3d578067652b12993bca13fb8e07dc45d062d4a5","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2m6g-p3vx-p2fh"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13479.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13479","state":"PUBLISHED","datePublished":"2026-08-26T14:03:47.708Z","dateUpdated":"2026-08-26T15:44:15.133Z","assignerShortName":"zephyr","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateReserved":"2026-06-27T13:33:55.407Z"},"containers":{"cna":{"title":"Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler","descriptions":[{"lang":"en","value":"The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload.\n\nThe payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener.\n\nThe over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.3.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["subsys/lorawan/services/clock_sync.c"]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/3d578067652b12993bca13fb8e07dc45d062d4a5","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2m6g-p3vx-p2fh","name":"GHSA-2m6g-p3vx-p2fh"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","description":"bounds","type":"CWE"}]}],"providerMetadata":{"shortName":"zephyr","orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateUpdated":"2026-08-26T14:03:47.708Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-26T15:44:08.607894Z","id":"CVE-2026-13479","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-26T15:44:15.133Z"}}]}}}