EUVD-2026-60268Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:L because exploitation requires a local user-mode thread; PR:L for a valid unprivileged thread context; S:C because successful exploitation crosses the userspace-to-kernel supervisor boundary.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any object validation - unlike every sibling flash syscall, which guards its device pointer with K_SYSCALL_DRIVER_FLASH.
A user-mode thread fully controls the values of src_dev/dst_dev and the contents of its own address space. The implementation z_impl_flash_copy() dereferences these pointers and calls through their driver-API function tables (e.g. api->get_parameters(dst_dev), flash_read(src_dev, ...), flash_write(dst_dev, ...)). By supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers, an unprivileged thread can cause the kernel to call arbitrary code in supervisor mode; passing any arbitrary or invalid address otherwise yields a kernel crash or out-of-bounds read.
The result is a local privilege escalation out of the userspace sandbox (with kernel denial-of-service and information disclosure as lesser outcomes). The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLASH(dst_dev, write) to z_vrfy_flash_copy(), which verify each device is a registered flash-driver kernel object the calling thread is permitted to use before any dereference, closing the path completely.
AnalysisAI
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) CONFIG_USERSPACE must be enabled at build time - this is the decisive condition; without it, z_vrfy_flash_copy() is not compiled and the attack surface does not exist; (2) the attacker must have code execution as a low-privileged user-mode thread on the target device (PR:L per CVSS vector - a valid Zephyr userspace thread context); (3) the flash_copy() syscall must be accessible to the calling thread (not restricted by Zephyr's thread permission system). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is internally consistent with the description: the attack is local, requires only a low-privileged user-mode thread (PR:L), involves no race condition or complexity (AC:L), and achieves a full scope change - breaking out of the Zephyr userspace sandbox into kernel supervisor mode - with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with code execution as a low-privileged user-mode thread on a Zephyr 4.0.0-4.4.1 device (CONFIG_USERSPACE enabled) allocates a forged struct device in their own address space, populating its api field with a pointer to an attacker-controlled function table. The thread calls flash_copy() passing the forged pointer as src_dev or dst_dev; z_vrfy_flash_copy() accepts the pointer without kernel-object validation, and z_impl_flash_copy() dereferences the forged API table and calls the attacker's function in supervisor mode, achieving full kernel privilege escalation. … |
| Remediation | Upgrade to Zephyr 4.4.2 or later, which incorporates the fix commit 1b1ecdc438092cdd469319a0d51cba6cf82e06f4 adding K_SYSCALL_DRIVER_FLASH object validation for both src_dev and dst_dev in z_vrfy_flash_copy(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit production and development systems for Zephyr deployments running versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled to identify affected assets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today