PT-2026-64764 · Zephyrproject · Zephyr
CVE-2026-10681
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
CVSS v3.1
6.5
Média
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L |
In Zephyr's userspace dynamic-objects subsystem, thread idx alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global thread idx map[] bitmap without holding lists lock.
On SMP systems, two user-mode threads invoking the k object alloc(K OBJ THREAD) syscall concurrently can both observe the same low free bit, perform the same non-atomic RMW to clear it, and return the identical tidx.
The two newly created K OBJ THREAD objects are then assigned the same thread id, so the two user threads alias a single bit position in every kernel object's perms[] bitfield: any subsequent grant of access on a kernel object to one thread is implicitly a grant to the other, defeating userspace ACL isolation. A secondary lost-update window between the unlocked &=~BIT() in alloc and the locked |= BIT() in thread idx free() can also leak entries from the thread-index pool.
The defect is reachable from any user-mode thread via the unrestricted syscall k object alloc and is gated on CONFIG USERSPACE, CONFIG DYNAMIC OBJECTS, and CONFIG SMP. The flaw was introduced when the per-thread permission index was added in 2018 and is present in every release up to and including v4.4.0. Fixed by holding lists lock across the bitmap RMW and the permissions clear (and inlining the obj list traversal that previously took the lock itself).
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zephyr