PT-2026-65092 · Zephyrproject · Zephyr
CVE-2026-10682
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
CVSS v3.1
6.6
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
The userspace verifier z vrfy log filter set() for the log filter set syscall in subsys/logging/log mgmt.c performed a signed comparison against the int16 t src id parameter: src id < (int16 t)log src cnt get(domain id). Any negative value for src id (e.g. -1) trivially satisfied this check and was forwarded into z impl log filter set, where it propagated to filter set() and ultimately to get dynamic filter(), which uses source id as an unsigned index into the linker-section array &TYPE SECTION START(log dynamic)[source id].filters.
After implicit conversion through uint32 t, an int16 t -1 becomes 0xFFFFFFFF, indexing log dynamic far out of bounds and causing the kernel to perform an OOB read and an OOB read-modify-write (LOG FILTER SLOT GET/SET) against memory adjacent to the log dynamic section.
The written value is a constrained 3-bit log level slot within the targeted 32-bit word, but the target address is attacker-chosen (a small negative offset from log dynamic) and the write occurs in supervisor mode following a syscall from an unprivileged user thread, providing a kernel memory-corruption / privilege-escalation primitive.
The defect is reachable on any build with CONFIG USERSPACE=y and CONFIG LOG RUNTIME FILTERING=y. Present from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an unsigned comparison: (uint32 t)src id < log src cnt get(domain id), which correctly rejects negative inputs.
Correção
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zephyr