CVE-2021-3431: 
NixOS vulnerability analysis and mitigation

CVE-2021-3431 is a vulnerability affecting Zephyr versions >= v2.5.0, characterized by a reachable assertion condition when handling repeated LLFEATUREREQ in the Bluetooth implementation. The vulnerability was discovered and disclosed in June 2021, with a fix released in version 2.6.0 (Vendor Advisory).

The vulnerability is classified as CWE-617 (Reachable Assertion) and received varying CVSS scores from different sources. The NVD assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while the Zephyr Project assessed it with a CVSS score of 4.3 (MEDIUM) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The vulnerability affects the availability of the system through an assertion failure triggered by repeated LLFEATUREREQ in the Bluetooth implementation. The impact is primarily focused on system availability, with no direct effects on confidentiality or integrity (Vendor Advisory).

The vulnerability has been patched in Zephyr version 2.6.0. The fix was implemented through pull requests #33340 for the main branch and #33369 for v2.5 (Vendor Advisory).