Zephyr & MCUboot Security Assessment Report

NCC Group performed an independent security assessment of the Zephyr RTOS and MCUboot (Jan–Feb 2020) and discovered 25 vulnerabilities in Zephyr and 1 in MCUboot, including memory corruption bugs that are locally and remotely exploitable, multiple user-to-kernel privilege escalation vectors, and weaknesses in kernel exploit mitigation designs; the full technical report (including discovered issues) is available for download.