CVE-2026-87038 Doble lectura TOCTOU en el manejador de la syscall i3c_transfer() de Zephyr permite secuestro de flujo de…
El manejador de verificación de modo usuario para la syscall i3c_transfer(), z_vrfy_i3c_transfer() en drivers/i3c/i3c_handlers.c, validaba la struct i3c_device_desc provista por el llamador en su lugar en vez de tomar una instantánea. Solo confirmaba que el descriptor era legible por el hilo llamador, leía target-bus una vez para verificarlo con K_SYSCALL_OBJ() y luego pasaba el puntero vivo del llamador. La implementación z_impl_i3c_transfer() vuelve a leer target-bus desde esa memoria de usuario y despacha a…
CVSS 3.1
- Probabilidad de explotación · EPSS del 09/110,1 % · percentil 0
- Explotada activamenteNo confirmada
- Exploit públicoNo conocido
Afectados
zephyrproject zephyr
desde 3.2.0 hasta antes de 4.3.2desde 4.4.0 hasta antes de 4.5.0
Qué hacer
- Verificá si usás zephyr y en qué versión.
- Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
- Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.
Calculadora CVSS
CVSS 3.1 · 7.0 ALTA
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Vector de ataqueLocal
- Complejidad del ataqueAlta
- Privilegios requeridosBajos
- Interacción del usuarioNinguna
- AlcanceSin cambio
- ConfidencialidadAlta
- IntegridadAlta
- DisponibilidadAlta
Descripción original
The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread (K_SYSCALL_MEMORY_READ()), read target->bus once to check it with K_SYSCALL_OBJ(), and then passed the caller's live pointer down. The implementation z_impl_i3c_transfer() re-reads target->bus from that user memory and dispatches through it as DEVICE_API_GET(i3c, target->bus)->i3c_xfers(...), so the bus that was validated is not necessarily the bus that is used. DEVICE_API_GET() performs no runtime type check outside CONFIG_DEVICE_API_ASSERT builds.
On a build with CONFIG_USERSPACE and an I3C controller driver, a user thread that has been granted an I3C device object can exploit this with a second thread in the same memory domain: one thread calls i3c_transfer() while the other rewrites the bus field of the descriptor. The window between the check and the use spans the num_msgs validation, the message-array access check, a stack VLA allocation and a memcpy() of up to 32 struct i3c_msg, so the race is repeatable and can simply be retried until it lands.
When the substitution succeeds, the kernel dereferences an attacker-chosen pointer as a struct device, loads a function pointer from the attacker-controlled api table and calls it in supervisor mode with attacker-influenced arguments. This yields kernel-mode code execution from an unprivileged user thread — a complete escape of the userspace memory-protection sandbox; lesser outcomes are an arbitrary two-level kernel read or a kernel fault. Builds without CONFIG_USERSPACE, or without an I3C driver, are unaffected.
The fix copies the descriptor into a kernel-stack local with k_usermode_from_copy(), validates the bus in that copy, and dispatches on the copy, so the validated value is provably the value used.
Referencias (2)
Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.