acassis commented on PR #20686:
URL: https://github.com/apache/nuttx/pull/20686#issuecomment-6383987056
@anchao I think enhancing the native stack is always the best option,
because we got an implementation that is not the same code from a foreign
project and are not affected by the same vulnerabilities.
Just to prove my point, from 2019 until now were 73 vulnerabilities found on
ZBlue:
(CVE-2019-9506, CVE-2020-10061, CVE-2020-10065, CVE-2020-10066,
CVE-2020-10068, CVE-2020-10069, CVE-2021-3430,
CVE-2021-3431, CVE-2021-3432, CVE-2021-3433, CVE-2021-3434, CVE-2021-3435,
CVE-2021-3436, CVE-2021-3454,
CVE-2021-3455, CVE-2021-3581, CVE-2021-3966, CVE-2022-1041, CVE-2022-1042,
CVE-2022-2993, CVE-2022-3806,
CVE-2023-0396, CVE-2023-0397, CVE-2023-1901, CVE-2023-1902, CVE-2023-4258,
CVE-2023-4264, CVE-2023-4424,
CVE-2023-5055, CVE-2023-5753, CVE-2024-1638, CVE-2024-3077, CVE-2024-3332,
CVE-2024-4785, CVE-2024-5754,
CVE-2024-5931, CVE-2024-6135, CVE-2024-6137, CVE-2024-6258, CVE-2024-6259,
CVE-2024-6442, CVE-2024-6443,
CVE-2024-6444, CVE-2024-8798, CVE-2025-7403, CVE-2025-9557, CVE-2025-9558,
CVE-2025-10456, CVE-2025-10457,
CVE-2025-10458, CVE-2025-12035, CVE-2025-12890, CVE-2026-2411,
CVE-2026-5068, CVE-2026-5589, CVE-2026-9263,
CVE-2026-10593, CVE-2026-10641, CVE-2026-10651, CVE-2026-10653,
CVE-2026-10654, CVE-2026-10658, CVE-2026-10660
CVE-2026-10675, CVE-2026-10680, CVE-2026-10685, CVE-2026-10774,
CVE-2026-11368, CVE-2026-11893, CVE-2026-11894
CVE-2026-12236, CVE-2026-13213, CVE-2026-15460, and counting)
21 only this year! You can think: good these are vulnerabilities that were
fixed and we will not be affected. The problem is the year didn't finish, they
will discover a lot more before the end of the year, and many more in the
coming years.
And since Zephyr is becoming used in more products from different vendors
(like Windows) it mean any product with NuttX will be affected as well.
Perhaps ZBlue could be a great stack (if you think so), but it could it is a
foreign code injected on NuttX in the most critical part of NuttX (kernel), it
means any vulnerability found on that stack will put a NuttX product in risk.
This is why I suggested to add a Kconfig "Bluetooth Support" and inside it
add:
```
[] NuttX Native BLE stack (WIP)
[] ZBlue (Zephyr Bluetooth stack)
[] NimBLE stack
```
I think we need to hear more from other developers, seems like only you and
I are interested on it.
Ping @xiaoxiang781216 @raiden00pl @hartmannathan @jerpelea @cederom
@michallenc @casaroli @simbit18
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
