doc: security: Disclose CVE-2024-3332 (f80c75c3) · Commits · Wenxi XU / zephyr

doc/releases/release-notes-3.7.rst

+2 −1

Changes for doc/releases/release-notes-3.7.rst: 2 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -82,7 +82,8 @@ https://docs.zephyrproject.org/latest/security/vulnerabilities.html
		* CVE-2024-3077 `Zephyr project bug tracker GHSA-gmfv-4vfh-2mh8
		<https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gmfv-4vfh-2mh8>`_

		* CVE-2024-3332 Under embargo until 2024-07-01
		* CVE-2024-3332 `Zephyr project bug tracker GHSA-jmr9-xw2v-5vf4
		<https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmr9-xw2v-5vf4>`_

		* CVE-2024-4785: Under embargo until 2024-08-07

+13 −1

Changes for doc/security/vulnerabilities.rst: 13 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -1720,7 +1720,19 @@ This has been fixed in main for v3.7.0
		CVE-2024-3332
		-------------

		Under embargo until 2024-07-01
		Bluetooth: DoS caused by null pointer dereference.

		A malicious BLE device can send a specific order of packet
		sequence to cause a DoS attack on the victim BLE device.

		- `Zephyr project bug tracker GHSA-jmr9-xw2v-5vf4
		<https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmr9-xw2v-5vf4>`_

		This has been fixed in main for v3.7.0

		- `PR 71030 fix for main
		<https://github.com/zephyrproject-rtos/zephyr/pull/71030>`_


		CVE-2024-4785
		-------------