EUVD-2026-46448Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector with low-privilege SPI device grant required; trivially simple once prerequisites met; availability-only kernel fault with no confidentiality or integrity impact.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.
spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().
On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.
The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
AnalysisAI
Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.
Technical ContextAI
Zephyr is a small-footprint RTOS targeting embedded and IoT platforms (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The DesignWare SPI driver (drivers/spi/spi_dw.c) computes the BAUDR clock divider register value as info->clock_frequency / config->frequency; CWE-369 (Divide By Zero) arises because the divisor is never range-checked. The spi_transceive function is a Zephyr __syscall, meaning it crosses the userspace/kernel boundary under CONFIG_USERSPACE=y. Its verify handler (drivers/spi/spi_handlers.c) marshals the caller's spi_config struct from userspace memory but omits validation of the frequency field, allowing a zero value to propagate into the kernel. On Cortex-M Mainline, SCB->CCR.DIV_0_TRP is armed in z_arm_fault_init(), converting the divide-by-zero into a UsageFault/kernel fault. On ARC, a dedicated __ev_div_zero exception vector triggers equivalently. The DesignWare SSI databook mandates a minimum SCKDIV of 2, so the fix also rejects frequencies above clock_frequency/2. There is no heap or stack corruption pathway; this is a pure availability-class defect.
RemediationAI
Upgrade to Zephyr v4.5.0 or any subsequent release that incorporates commit 65935885622b0e4a5dbe5b82504c30097eb75ce0, which adds two input-validation guards in spi_dw_configure(): rejection of zero frequency with -EINVAL and rejection of frequencies exceeding clock_frequency/DW_SPI_MIN_SCKDIV (where DW_SPI_MIN_SCKDIV=2, per the DesignWare SSI databook) also with -EINVAL. The patch and advisory are at https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0 and https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3qcm-qwh2-v4hq respectively. If upgrading is not immediately feasible, two compensating controls are available: first, rebuild the firmware with CONFIG_USERSPACE=n, which eliminates the syscall boundary entirely and prevents untrusted threads from reaching the vulnerable path (trade-off: disables the userspace isolation model across the entire application); second, audit all calls to k_object_access_grant() and k_thread_access_grant() for SPI devices and ensure no untrusted thread receives SPI device object access (trade-off: requires manual code review and does not prevent privileged threads from triggering the fault via misconfiguration).
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-369 – Divide By Zero
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today