Insights from Zephyr Security Audit and Vulnerability Experiences
summary
Audit work reveals an initial independent review that finds 26 vulnerabilities across subsystems and a later contracted audit focused on user mode/kernel focus that reports three actionable issues, mostly low severity, plus one real integer overflow. Vulnerability trends over three years show most CVEs in Network and Bluetooth and common CWEs are buffer and integer overflows. Process changes include a 90‑day embargo with a 30‑day fix goal, mandatory static analysis cadence, push for fuzzing where feasible, and updated training and documentation.
AI-written summary · about
chapters (10)
- 0:00Zephyr and security team
- 3:35Embedded security challenges
- 8:30Tracking CVEs and alerts
- 11:41Recent vulnerabilities in Zephyr
- 18:50Common vulnerability types
- 20:15External security audits
- 26:56Lessons from security audit
- 30:31Enhancing security strategies
- 34:10Audit outcomes and confidence
- 35:36Q&A on CVEs
related talks
46mInsights from Zephyr Security Audit and Vulnerability Experiences
29mLessons Learned on Following Security Best Practices in Zephyr
40mThe Zephyr Project Security Overview, Progress, and Status
40mZephyr Project Security Status
57mSecurity Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines
40mZephyr: Evolving To CRA Readiness
47mA Root Canal Static Analysis Based Audit of Zephyr
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...