EUVD-2026-64897Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Local-only vector (AV:L), race-condition timing requirement (AC:H), and unprivileged-thread prerequisite (PR:L) match the described TOCTOU; scope change (S:C) reflects the userspace-to-supervisor boundary crossing with no integrity impact.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.
On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).
The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
AnalysisAI
Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | CONFIG_USERSPACE must be explicitly enabled in the Zephyr build configuration - this is not universally default and must be intentionally configured by the system integrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L is well-calibrated to the actual threat: local-only access (AV:L) and high complexity (AC:H) reflect the requirement to win a precise race condition between two threads, substantially lowering practical exploitability compared to network-exploitable or trivially triggered flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to an unprivileged userspace thread on a Zephyr CONFIG_USERSPACE build spawns a second thread sharing the same address space and begins spinning to overwrite msg->data with a target kernel address (e.g., a known kernel data structure) immediately after the mbox_send() syscall is entered. When the race is won between the verifier's K_SYSCALL_MEMORY_READ check and the driver's subsequent memcpy, the driver reads bytes from the attacker-controlled supervisor address in kernel context and forwards them to the mailbox peer endpoint, leaking kernel memory contents. … |
| Remediation | Upgrade to Zephyr 4.4.2 or later, which incorporates the fix from upstream commit ab35eaccec5976f05c196f176d0c32885754496f; the patch and advisory are available at https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f and https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today