CVE-2020-10061: 
NixOS vulnerability analysis and mitigation

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This vulnerability affects Zephyr RTOS versions 2.2.0 and later versions, as well as version 1.14.0 and later versions. The vulnerability was assigned CVE-2020-10061 and was disclosed in March 2020 (CVE-MITRE).

The vulnerability stems from improper handling of invalid packet sequences in the Bluetooth controller implementation. When a rough central device uses invalid packet sequence numbers, it can cause NULL pointer to be released into free data Tx pool, leading to memory corruption. The issue affects both the legacy and split driver implementations of the Bluetooth controller (Zephyr Docs).

The vulnerability can result in memory corruption in the Zephyr Bluetooth implementation. This could potentially lead to system instability or denial of service conditions in affected devices (CVE-MITRE).

The vulnerability requires an attacker to be within Bluetooth range of the target device and able to send specifically crafted packets with invalid sequence numbers to trigger the memory corruption condition (AttackerKB).

The vulnerability has been fixed in multiple versions of Zephyr RTOS. Patches were released for v1.14.0, v2.2.0, and included in v2.3.0. Users should update to the patched versions. The fixes include improvements to handle invalid packet sequences and prevent memory corruption (Zephyr Docs).