CVE-2024-1638 is a high severity (CVSS 8.2) flaw in Zephyr RTOS. The BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC flags only require LE Secure Connections when combined with other permissions, which the documentation does not make clear. The GitHub advisory lists no patched version, so fix your code.
What's affected
The Zephyr advisory (GHSA-p6f3-f63q-5mc2, published 19 February 2024) rates the issue High, lists affected versions as 3.5.0 and earlier, and lists patched versions as none. The NVD record gives 8.2 (high) and the weakness CWE-20 (improper input validation).
The issue is about how the permission flags combine. The documentation says the LESC flags require LE Secure Connections for read or write access. In practice that holds only when the characteristic also sets an encrypt or authen permission (BT_GATT_PERM_READ_ENCRYPT or BT_GATT_PERM_READ_AUTHEN for reads, BT_GATT_PERM_WRITE_ENCRYPT or BT_GATT_PERM_WRITE_AUTHEN for writes).
How to check if you're exposed
Search your firmware source for characteristics that use the LESC flags.
grep -rn "PERM_READ_LESC\|PERM_WRITE_LESC" src/
For each hit, look at the other permission flags in the same definition. A characteristic that has a LESC flag but no encrypt or authen flag is exposed to the gap described above. Also record which Zephyr release your product builds against, since the advisory lists 3.5.0 and earlier.
What to do now
- List every GATT characteristic that sets a LESC permission.
- Add the matching encrypt or authen permission so that the intended protection applies.
- Rebuild and test pairing behavior with a device that does not use LE Secure Connections.
- Check the Zephyr advisory and release notes for any later change, since no patched version was listed when we read it.
- Ship the firmware update to deployed devices through your normal channel.
Why it matters
A security flag that does not do what its name suggests is a trap. Developers set the flag, assume access is restricted, and move on. The gap shows up only when a peer that does not use LE Secure Connections tries to read or write the characteristic.
The class is CWE-20 (improper input validation) in the NVD record. For embedded products the harder part is the update path, since fielded devices may not be patched for years. The record does not flag the issue as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Is there a patched Zephyr version?
The advisory we read lists patched versions as none. The recommended action is to change how characteristics combine permission flags, and to check the advisory for updates.
Sources
Last reviewed: 19 October 2026.
