A critical use-after-free vulnerability in the Zephyr RTOS Bluetooth stack allows unauthenticated remote attackers to achieve arbitrary memory corruption.

The vulnerability exists in the bt_conn_tx_processor function where improper handling of memory objects leads to a use-after-free condition. An unauthenticated attacker can leverage this flaw to perform a write-what-where operation, specifically controlling 4 bytes of data to corrupt system memory.

Successful exploitation of this vulnerability can lead to system instability, denial of service, or potentially remote code execution depending on the specific device configuration. With a CVSS score of 7.6, this flaw poses a significant risk to the integrity and availability of embedded systems utilizing the Zephyr Bluetooth stack. Unauthorized memory modification in an RTOS environment often facilitates a complete compromise of the device control plane.

Immediate Action: Review the official Zephyr Project security advisory at the provided reference and apply the recommended patches or configuration hardening steps as soon as they are released by the vendor.

Proactive Monitoring: Monitor Bluetooth traffic and system logs for unexpected crashes or anomalous behavior within the bt_conn_tx_processor task.

Compensating Controls: If patching is delayed, restrict Bluetooth connectivity to trusted devices and segment affected hardware from critical network segments to limit the attack surface.

Public Exploit Available: No (exploit_available: false).

Given the potential for arbitrary memory corruption, this vulnerability should be treated with high priority. Organizations utilizing Zephyr RTOS must track the vendor's security portal for the release of a definitive patch and plan for an immediate firmware update cycle upon its availability.