Insights from Zephyr Security Audit and Vulnerability Experiences
summary
External third‑party audits find concrete results: a recent NCC Group engagement spends six weeks on core kernel user‑mode code and returns 3 issues found in recent audit (two low severity, one informational) while an earlier engagement reported 26 defects; analysis of three years of GitHub CVEs shows buffer overflows dominate particularly in Network and Bluetooth subsystems. The project enforces a 90‑day embargo with a 30‑day fix target, makes static analysis mandated, adds embedded‑focused security training, and patches architecture issues including an ARM MMU bug.
AI-written summary · about
chapters (13)
- 0:00Zephyr security audit intro
- 1:27Zephyr RTOS security needs
- 3:35Zephyr security features and limits
- 5:05Zephyr security groups and processes
- 6:11Tracking CVEs and alerts
- 9:27Three years of Zephyr vulnerabilities
- 11:32Common Zephyr vulnerability types
- 13:41External code audit context
- 18:41NCC Group 2023 Zephyr audit
- 26:56Audit lessons learned
- 29:49Next steps for Zephyr security
- 34:10Audit conclusions and future plans
- 35:36Q&A on CVEs and security
related talks
46mInsights from Zephyr Security Audit and Vulnerability Experiences
29mLessons Learned on Following Security Best Practices in Zephyr
40mThe Zephyr Project Security Overview, Progress, and Status
47mA Root Canal Static Analysis Based Audit of Zephyr
40mZephyr Project Security Status
57mSecurity Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines
43mZephyr Project: Results from Applying Open Source and Security Best Practices
10mExtending Security to Resource Constrained Devices