The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result. That macro is a pure expression that does not assign to gw, so gw retained its NULL initializer regardless of the list contents. The code then dereferences the NULL gw (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL). With CONFIG_MEM_SLAB_POINTER_VALIDATE enabled this triggers k_panic(); in the default configuration it performs a write through the NULL pointer ((char )mem = slab->free_list;) and corrupts the slab free list. The outcome is a crash/kernel panic or, on targets where address 0 is writable, silent memory-allocator corruption. The vulnerable branch runs whenever the connected MQTT-SN gateway fails to answer keepalive PINGREQs for the configured number of retries. This condition is controlled by the remote peer: a malicious or compromised gateway, or an on-path/adjacent attacker that advertises itself as a gateway and then stops responding (or blackholes the real gateway's PINGRESPs), forces the client into the defect. MQTT-SN runs over UDP and no authentication is required. The impact is a remotely triggerable denial of service (availability) of the affected MQTT-SN client; there is no attacker-controlled data written. The sibling remover process_advertise() uses SYS_SLIST_FOR_EACH_CONTAINER_SAFE and is not affected. The fix assigns the macro's return value to gw.
| Métrique | Valeur | Interprétation |
|---|---|---|
|
AV (Vecteur d'Attaque)
Attack Vector
|
Network (N)
|
Exploit possible à distance via réseau (HTTP, API, etc.) |
|
AC (Complexité d'Attaque)
Attack Complexity
|
Low (L)
|
Peu de conditions requises pour exploiter |
|
PR (Privilèges Requis)
Privileges Required
|
None (N)
|
Aucune authentification requise |
|
UI (Interaction Utilisateur)
User Interaction
|
None (N)
|
Aucune interaction utilisateur nécessaire |
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis |
|
C (Impact Confidentialité)
Confidentiality Impact
|
None (N)
|
Aucune divulgation d'informations |
|
I (Impact Intégrité)
Integrity Impact
|
None (N)
|
Aucune modification de données possible |
|
A (Impact Disponibilité)
Availability Impact
|
High (H)
|
Interruption totale du service possible |
NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway