Zephyr Stack Overflow Vulnerability via ICMP Ping to Self

A stack overflow vulnerability has been identified in Zephyr versions through 4.3. When the 'net ping' command is issued to a device's own IPv4 address, the network stack recursively processes the echo request and reply inline, leading to a stack overflow. This occurs because the destination is treated as local, causing the nested input frames to exceed the work-queue stack limit. The issue has been observed in the 'samples/net/sockets/echo_server' application.

Impact

Exploitation of this vulnerability causes a stack overflow, leading to a bus fault and a fatal error, halting the system.

Reproduction

To reproduce this vulnerability, configure a Zephyr device with an IPv4 address. Then, build and upload the 'samples/net/sockets/echo_server' application. Once the application is running, issue the 'net ping' command to the device's own IPv4 address. The network stack will recursively process the echo request and reply, causing a stack overflow.