russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.4 KiB

Raw Blame History

Zephyr RTOS — CWE-312 Disclosure Brief (zephyr-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 credential exposure defect in Zephyr's WiFi management subsystem. WiFi PSK and SAE passwords are dumped as raw hex via LOG_HEXDUMP_DBG on every connection attempt. Patched.

The Defects

zephyr-0002 (PATCHED — HIGH): subsys/net/l2/wifi/wifi_mgmt.c:396

// In wifi_connect() — fires on every WiFi connection attempt:
LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");          // PSK in hex!
if (params->sae_password) {
    LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");  // SAE password in hex!
}

LOG_HEXDUMP_DBG fires at LOG_LEVEL_DBG. When CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification testing), the PSK is dumped in cleartext hex to whatever logging backend is active (RTT, UART, flash logging). On boards with persistent logging backends, the WiFi passphrase is stored at rest.

Impact

Zephyr is the leading open-source RTOS for IoT devices, deployed on millions of constrained devices. WiFi debug logging is commonly enabled during board bring-up, driver development, and WiFi certification testing. Developers share logs publicly in GitHub issues and forum posts. On devices with flash-based logging backends, credentials persist at rest. The PSK grants full WiFi network access.

The Fix

zephyr-0002: Remove PSK/SAE hex dumps; log only presence indicators:

// Before — dumps credentials in hex
LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");

// After — safe diagnostic only
LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
LOG_DBG("sae_password set: %s",
    (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");

Patch

Fix available: defects/zephyr-0002/patch/zephyr-0002.patch

Single-file patch in subsys/net/l2/wifi/wifi_mgmt.c.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (zephyrproject-rtos/zephyr).
Assess severity — logs WiFi PSK in hex on every connection attempt at debug level.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Zephyr team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Blame History