CVE-2021-3330

This is a memory-corruption bug deep in the Zephyr RTOS network stack: a forged fragment list corrupts a linked list during sorting, producing a large out-of-bounds write. The advisory frames it as RCE/DOS, meaning a crafted set of fragments sent to the device can at minimum crash it and potentially be steered into code execution. The vector points to an adjacent-network attacker — this comes from something on the same link, not the open internet.

Zephyr runs on embedded and IoT devices, which shapes the threat: these are constrained targets, often deployed in fleets, frequently without exploit mitigations that a general-purpose OS would have, and notoriously slow to receive firmware updates. An out-of-bounds write in fragment handling is reachable by anyone who can put crafted packets on the local segment, so in environments where such devices share a network with less-trusted hosts, the DoS is very plausible and the code-execution ceiling is a genuine concern. It's not mass-internet-scanned, but it's dangerous where an attacker already has adjacency.

Our challenge with this class is that embedded firmware is the hardest thing to inventory and patch, so we lean on segmentation. The realistic mitigation is isolating Zephyr-based devices onto trusted network segments where an attacker can't reach them with forged fragments, while tracking which products build on the affected 2.4.0-and-later versions for firmware updates as vendors ship them. We rank it by network adjacency: reachable-from-untrusted is urgent, air-gapped or tightly segmented is far less so.