The Zephyr Project Security Overview, Progress, and Status
summary
Zephyr security timeline and mechanics get described with concrete details: the repo contains 1.3 million lines of C plus ~20 million in modules, vulnerabilities enter a private GitHub advisory workflow with a 90 day embargo, a recent incident delivered 26 vulnerabilities at once, fixes land via PRs and a cherry‑pick bot into LTS branches, and practical gaps remain such as GitHub security advisories lack API and unstable crypto backends like tinycrypt needing maintainers.
AI-written summary · about
chapters (9)
- 0:00Introduction to Zephyr security
- 4:54Understanding vulnerabilities
- 8:43Vulnerability management
- 20:41Security governance
- 26:51Cryptographic libraries
- 27:07Dependency management
- 30:42Question and answer session
- 32:20Rootkits and threat models
- 35:00Entropy and RNG standards
related talks
40mZephyr Project Security Status
43mZephyr Project: Results from Applying Open Source and Security Best Practices
40mZephyr: Evolving To CRA Readiness
29mLessons Learned on Following Security Best Practices in Zephyr
46mInsights from Zephyr Security Audit and Vulnerability Experiences
46mInsights from Zephyr Security Audit and Vulnerability Experiences
10mExtending Security to Resource Constrained Devices
23mKeynote: Zephyr & IoT Security