EUVD-2026-44746Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only attack vector (physical single-pair Ethernet segment required); no authentication, privileges, or interaction needed; full memory corruption potential justifies C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and the write cursor scur advanced, with no check that scur + len stayed within the buffer. The number of chunks (up to 255, from the BUFSTS RCA field) and the per-chunk length are taken entirely from the frame data received off the wire; the cursor is only reset on a start-of-frame chunk. An attacker on the single-pair Ethernet segment can therefore send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory (up to roughly 14.8 KB in the worst case). This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution. The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy.
AnalysisAI
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Technical ContextAI
The affected code is in drivers/ethernet/eth_adin2111.c within the Zephyr RTOS kernel, specifically the eth_adin2111_oa_data_read() function that handles frame reassembly in OPEN Alliance (OA) SPI protocol mode - the interface used by Analog Devices ADIN2111 (dual-port) and ADIN1110 (single-port) 10BASE-T1S/T1L Ethernet MAC-PHY chips for host communication over SPI. In OA SPI mode, received Ethernet frames arrive as 64-byte data chunks; the driver accumulates them sequentially into ctx->buf (a static buffer sized by CONFIG_ETH_ADIN2111_BUFFER_SIZE, defaulting to 1524 bytes) using a write cursor ctx->scur. The chunk count (up to 255, from the BUFSTS RCA hardware register field) and per-chunk length are derived directly from wire data without sanitization. CWE-787 (Out-of-Bounds Write) is the root cause: because the cursor increment (scur += len) was never checked against the buffer ceiling before the memcpy, an attacker controlling the frame data controls both the write offset and the bytes written beyond the buffer. The CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* covers affected versions 3.7.0 through 4.4.x, introduced with OA SPI support in commit 0ca8b0756b1.
RemediationAI
Upgrade to Zephyr RTOS 4.5.0 or later, which contains the bounds check added in commits 158df8d088316cdae20816fc07703892280b2acb and c98321cbfef23c0e3bdf043ccf6b421067c8d508; the fix inserts a check in eth_adin2111_oa_data_read() that compares ctx->scur + len against CONFIG_ETH_ADIN2111_BUFFER_SIZE before each memcpy, dropping the frame and resetting the cursor if the size would be exceeded. Patch commits are at https://github.com/zephyrproject-rtos/zephyr/commit/158df8d088316cdae20816fc07703892280b2acb and https://github.com/zephyrproject-rtos/zephyr/commit/c98321cbfef23c0e3bdf043ccf6b421067c8d508. If an immediate upgrade is not feasible, consider disabling OA SPI mode in the driver configuration and using a non-OA SPI mode if your hardware supports it - this eliminates the vulnerable reassembly code path but may require firmware changes and hardware re-validation. Alternatively, physically restrict access to the 10BASE-T1S/T1L network segment so only trusted devices share the bus, reducing the adjacent-network attack surface; note this is a network control, not a software fix, and does not remove the underlying vulnerability.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today