Zephyr Project Security Status
summary
Zephyr is a Linux Foundation RTOS with ~107 authors and hundreds of commits monthly, now meeting CII Gold practices and acting as a CVE numbering authority with about four official CVEs so far. Practical security work includes an auditable branch for certification-ready code, refactoring the entropy API to separate cryptographic randomness, integration with MCUboot secure boot and SUIT manifests for OTA, static analysis, CI building ~170 targets, and exploration of fuzzing and FIPS paths.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:47Ok, What is Zephyr • Open Source: Apache 2.0 Open Linux Foundation project, in git github-style, maintainers, mailing list, and meetings
- 3:39Key differences from Linux • Generally single address-space (maybe MPU) . Usually no dynamic code Many things are compile-time, not dynamic . Intended for microcontrollers. Think 1003 KB and 10s
- 5:50Zephyr Security Past What is done Present: What we're doing Future: What we want to do
- 12:47Zephyr Security Subcommittee . One person from each platinum member silver members by invitation • A security Chair elected by the subcommittee Responsible for running bi-weekly meeting Sets ogenda and takes notes . A security architect elected by the subcommittee • Responsible for overall project security . Maintainers to seek signoff for significant changes
- 16:07Code repositories: Auditable • Stable branches off of LTS Subset of the code Frozen in time
- 17:24Ongoing work • Described in project documents Code guidelines How to report vulnerabilities • Process for a security bug JIRA instance to manage bugs during embargo
- 22:06Ongoing example: randomness • Open PR updating entropyrandom framework • Addresses multiple security issues Discussed within subcommittee meeting In this case worked on by someone in team . Goal clearer API and docs so it is easier to do things
- 24:09Aims: Crypto Drivers . Same API for different implementations • Provided by hardware, e.g. Atmel ATAES132A . Provided by software
- 26:21Aims: FIPS 140-2/3 . Common for cryptographic modules Generally, certifies products But, certification of ouditable helps that process • Focus is on crypto operations
- 30:57Aims: Fuzzing . Most fuzzing work done on bigger systems than Zephyr targets Research into QEMU-based fuzzer . Other possibilities Existing fuzzers often assure lots of memory Pasix Native part can help with some areas • Open area for research
related talks
43mZephyr Project: Results from Applying Open Source and Security Best Practices
40mThe Zephyr Project Security Overview, Progress, and Status
10mExtending Security to Resource Constrained Devices
05mZephyr
40mZephyr: Evolving To CRA Readiness
23mKeynote: Zephyr & IoT Security
29mLessons Learned on Following Security Best Practices in Zephyr
38mZephyr: Learnings From Working on Safety Certification in the Open