A critical vulnerability in the Zephyr RTOS MQTT-SN client allows unauthenticated remote attackers to trigger a denial of service or memory corruption by manipulating keepalive responses.

The vulnerability exists in the process_ping function within the MQTT-SN subsystem, where an unauthenticated remote attacker can force a NULL pointer dereference by failing to respond to PINGREQ packets. This flaw causes the system to attempt a memory operation on a null address, resulting in a kernel panic or corruption of the slab allocator.

Successful exploitation of this vulnerability results in a denial of service for any device utilizing the Zephyr MQTT-SN client. Given the CVSS score of 7.5, the risk is high, particularly for industrial or IoT environments where continuous availability is critical. Furthermore, the potential for silent memory corruption could lead to unpredictable system behavior that is difficult to diagnose.

Immediate Action: Update the Zephyr RTOS codebase to version 4.4.2 or later, which includes the necessary fix to properly assign the gateway record pointer.

Proactive Monitoring: Monitor network traffic for MQTT-SN gateway communication anomalies, specifically looking for repeated PINGREQ timeouts or unexpected gateway disconnections.

Compensating Controls: If patching is not immediately feasible, restrict network access to the MQTT-SN client to trusted gateways only and implement strict network segmentation to limit the exposure of the MQTT-SN port.

Public Exploit Available: No

This vulnerability represents a significant stability risk for embedded systems relying on Zephyr RTOS. Because the exploit vector is unauthenticated and triggered by standard network behavior, the potential for disruption is substantial. Organizations should prioritize updating to version 4.4.2 to ensure the integrity of the memory management subsystem and prevent remote denial of service attacks.