NRF Connect SDK / NRFXLIB security vulnerabilities

[Jameson]

I am currently in the process of filling out the 18031 RED Cybersecurity certification documentation.  I am currently analyzing the security vulnerabilities list of NCS v1.4.2 (link below) and noticed that its only referencing vulnerabilities for the zephyr project.  I had a couple questions for your team.

1. Do the other main libraries (NCS and NRFXLIB) have a list of security vulnerabilities that would be applicable to the 18031?
2. Are there any other libraries security vulnerabilities that would also be applicable to the 18031?  I'm currently assessing specific version of mbed_tls as well for any security vulnerabilities. 

Any info on this subject would be greatly appreciated!

docs.nordicsemi.com/.../vulnerabilities.html

[Øyvind]

Hello, I've been assigned you ticket and currently investigating internally. 

I hope to get back to you within Thursday or Friday this week. 

Kind regards,
Øyvind

[Jameson]

Thanks Øyvind!

I have some additional questions as well based on me digging in more.

3. I think I misunderstood the `vulnerabilities.html` document as being the active vulnerabilities for the zephyr product.  After reading the top it seems like its the vulnerabilities RESOLVED for the current release.  Can you confirm?

4. I looked up the specific zephyr product/version in the NVD that I'm using ncs 1.4.2 and zephyr 2.4.0 (its a bit behind).  Would this be the correct list to reference for current vulnerabilities for the zephyr repo used within the nrf connect sdk?   

https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Ao%3Azephyrproject%3Azephyr%3A2.4.0%3A-%3A*%3A*%3A*%3A*%3A*%3A*

[Øyvind]

Hello again, and my apologies for the late reply. 

From what I'm informed we are in a process of publishing a public vulnerability list on our website but unfortunately this is still work in progress.  For mbed-TLS the list of vulnerability should be compared to the mbed-TLS public git repo. NCS 1.4.2 integrates v2.23.0 of mbed-TLS. However, Zephyr may also be using this version. Are you using MCUboot?

Jameson said:

4. I looked up the specific zephyr product/version in the NVD that I'm using ncs 1.4.2 and zephyr 2.4.0 (its a bit behind).  Would this be the correct list to reference for current vulnerabilities for the zephyr repo used within the nrf connect sdk?   

This seems to be an accurate list. Zephyr doesn't backport fixes to all previous versions, but unfortunately and in most cases when a vulnerability is found it affects all previous versions (or at least until the point the new piece of code was added). As the Zephyr version you are using is quite old, there is no surprise that it has some vulnerabilities

Kind regards,
Øyvind

[Jameson]

Thanks for the info!  Yea I think that answers things, I'll wait to hear when those public vulnerabilities are provided.  Until then I'm just going to rely on the NVD database for things.  

Øyvind said:

Are you using MCUboot?

No we are not using MCUboot.  We were very early integrators of the NRF9160 and for security reasons ended up making our own bootloader.