CVE-2023-7060: 
NixOS vulnerability analysis and mitigation

A vulnerability in Zephyr OS (CVE-2023-7060) was identified affecting IP packet handling. The vulnerability exists because Zephyr OS does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.0.1 or the destination address. This affects Zephyr OS versions 3.5, 3.4, 2.7, and all other releases supporting IPv6 or IPv4 (Zephyr Advisory, SecurityWeek).

The vulnerability has been assigned a CVSS score of 8.6 (High severity). The issue affects both IPv4 and IPv6 interfaces with TCP and UDP connections. While most routers typically drop such IP packets before reaching the destination address, Zephyr OS's failure to implement this security control creates a vulnerability. The code executed is not dependent on the interfaces and the behavior remains consistent across different interfaces, including WLAN (Zephyr Advisory).

The vulnerability can be exploited to bypass host-side IP address-based access control. Additionally, it makes test targets more vulnerable to DoS attacks since answers are handled by loopback interfaces. In certain situations, this can cause the kernel to crash, particularly with IPv4 and IPv6 packets over TCP connection against echo_server and dump_http_server_mt test targets (Zephyr Advisory).

The vulnerability was discovered using Defensics testing tool. The issue affects both IPv4 and IPv6 interfaces with TCP and UDP connections, and has been tested in native simulator with ethernet interface (Zephyr Advisory).