Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Zephyr RTOS Fixes Bluetooth Bugs That May Lead to Code Execution

Zephyr RTOS Fixes Bluetooth Bugs That May Lead to Code Execution

The Zephyr real-time operating system (RTOS) for embedded devices received an update earlier this month that fixes multiple vulnerabilities that can cause a denial-of-service (DoS) condition and potentially lead to remote code execution.

The issues were discovered in Zephyr’s Bluetooth LE Link Layer (LL) and its implementation of the Logical Link Control and Adaptation Protocol (L2CAP).

Despite being a small open-source project, Zephyr is backed by big names in the industry like Facebook, Google, Intel, Nordic Semiconductors, and Adafruit.

The operating system supports more than 200 boards with various CPU architectures (ARM, Cortex-M, Intel x86, ARC, NIOS II, Tensilica Xtensa, SPARC V8, RISC-V 32), making it an attractive choice for makers of small embedded devices (hearing aids, smart tags, distancing trackers, safety pods for smart PPE, IoT gateways, portable backup devices).

Bugs exploitable with a single packet

Matias Karhumaa, a senior software engineer at Synopsys, an American electronic design automation (EDA) company, found eight vulnerabilities in Zephyr after testing the lowest layers of the operating system’s Bluetooth LE stack.

The flaws are all in the Bluetooth LE Link Layer and the L2CAP implementation. Most of them affect Zephyr versions 2.5.0 and 2.4.0; some are also present in version 1.14.

Exploiting most of them prevents the vulnerable device from working either by causing them to freeze or misbehave in a way that prevents other systems from connecting to it.

Also Read: The DNC Singapore: Looking At 2 Sides Better

In a report today, Synopsys says that freezing the device may lead to remote code execution under certain circumstances and that attackers can trigger the condition on vulnerable devices over the air using a single packet.

In the case of one vulnerability (CVE-2021-3435, high severity score), exploiting it causes an information leak that could include sensitive details. By sending one malformed L2CAP_CREDIT_BASED_CONNECTION_REQ packet, an attacker can read up to 6 bytes of uninitialized memory content.

Another high-severity vulnerability is tracked as CVE-2021-3455. It causes a DoS condition on the system but also has the potential for remote code execution by exploiting a use-after-free issue in Zephyr’s L2CAP implementation.

CVE IDSeverity scoreImpactHost / ControllerDescription
CVE-2021-34305.9 (Medium)Freeze (Zephyr 2.5.0, 2.4.0, 1.14)ControllerAssertion failure on repeated LL_CONNECTION_PARAM_REQ
CVE-2021-34315.9 (Medium)Freeze (Zephyr 2.5.0, 2.4.0)ControllerAssertion failure on certain repeated LL packets
CVE-2021-34325.9 (Medium)Freeze (Zephyr 2.5.0, 2.4.0, 1.14)ControllerInvalid interval in CONNECT_IND leads to Division by Zero
CVE-2021-34333.9 (Low)Deadlock (Zephyr 2.5.0, 2.4.0, 1.14)ControllerInvalid channel map in CONNECT_IND results to Deadlock
CVE-2021-34347.7 (High)Freeze (Zephyr 2.5.0, 2.4.0)HostL2CAP: Stack based buffer overflow in le_ecred_conn_req()
CVE-2021-34355.9 (Medium)Information leak (Zephyr 2.5.0, 2.4.0)HostL2CAP: Information leakage in le_ecred_conn_req()
CVE-2021-34545.9 (Medium)Freeze (Zephyr 2.5.0, 2.4.0)HostL2CAP: Truncated L2CAP K-frame causes assertion failure
CVE-2021-34557.7 (High)Freeze (Zephyr 2.5.0, 2.4.0)HostDisconnecting L2CAP channel right after invalid ATT request leads to use-after-free

Technical details are available in Karhumaa’s post. The engineer found the first Bluetooth-related vulnerabilities in Zephyr RTOS in early February and reported them privately to the developer.

Also Read: 4 Best Practices on How to Use SkillsFuture Credit

A new Zephyr version, 2.6.0 has been released at the beginning of the month to include fixes for all the security vulnerabilities in the table above.

“Product manufacturers using the Zephyr OS in their product are encouraged to update their Zephyr version to include latest security fixes. Zephyr’s security policy guarantees that security patches are backported to the two most recent releases and to active LTS release,” Karhumaa writes.

“For non-LTS Zephyr versions, manufacturers may need to take care of backporting the security patches themselves,” the engineer added.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us