PT-2026-62126 · Zephyrproject · Zephyr
CVE-2026-10679
·
Publicado
2026-07-21
·
Atualizado
2026-07-21
CVSS v3.1
3.3
Baixa
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
The DesignWare SPI driver (drivers/spi/spi dw.c) computed the SPI BAUDR clock divider as info->clock frequency / config->frequency without validating config->frequency.
spi transceive is a Zephyr syscall and its verify handler (drivers/spi/spi handlers.c) copies the caller-supplied spi config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi dw configure().
On Cortex-M Mainline (SCB->CCR.DIV 0 TRP is set in z arm fault init()) and on ARC (a dedicated ev div zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.
The fix rejects zero frequency and frequencies above clock frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Correção
Divide By Zero
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zephyr