CVE-2021-3433: 
NixOS vulnerability analysis and mitigation

CVE-2021-3433 is a vulnerability affecting Zephyr versions 2.5.0 and later, discovered in June 2021. The vulnerability involves an invalid channel map in CONNECT_IND that results in a deadlock condition, classified as an Improper Check or Handling of Exceptional Conditions (CWE-703) (NVD, Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. This indicates a local attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, with no impact on confidentiality or integrity but low impact on availability (NVD).

The vulnerability affects system availability through a deadlock condition caused by invalid channel map handling in CONNECT_IND. While the impact is limited to availability with no effect on confidentiality or integrity, it could potentially cause system disruption (Vendor Advisory).

The vulnerability has been patched in Zephyr version 2.6.0. Users are advised to upgrade to this version or apply the available patches. The fix has been implemented in the main branch through PR #33278 and in v2.5 through PR #33369 (Vendor Advisory).