CVE-2026-10669

{"id": "CVE-2026-10669", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10669", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:30:37.607534Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.7.0", "lessThan": "4.3.1", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.1", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["arch/xtensa/core/mpu.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-07-14T15:16:55.210", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/3b1bdaf5482188ca110ef9a411aaa8c7d3db3b16", "tags": ["Patch"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4r4p-gh69-v6w4", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c \u2014 the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission \u2014 defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of the buffer wraps the 32-bit address space (size + alignment offset near SIZE_MAX, or ROUND_UP(size + offset) overflowing to 0), the loop executes zero iterations and the function returns 0 = permitted without probing any MPU region.\n\nThe syscall-layer pre-checks (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) only catch a raw addr+size wrap and do not cover the ROUND_UP-induced wrap, and the string path (arch_user_string_nlen -> arch_buffer_validate) has no syscall-layer guard at all.\n\nAn unprivileged user-mode thread can therefore pass a crafted (addr, size) to any syscall that validates user buffers via k_usermode_from_copy/to_copy or k_usermode_string_copy and have validation succeed for memory it must not access; the kernel then reads from (disclosure) or, with write=1, writes to (corruption) attacker-chosen kernel or other-partition memory on the thread's behalf, enabling information disclosure, memory corruption, privilege escalation, and denial of service.\n\nAffected from v3.7.0 (when Xtensa MPU userspace support was added) through v4.4.0. The fix changes the default to -EINVAL (deny by default), adds an explicit size_add_overflow check, and sets the success value only after the full range has been validated."}, {"lang": "es", "value": "En SoCs Xtensa construidos con CONFIG_XTENSA_MPU y CONFIG_USERSPACE, arch_buffer_validate() en arch/xtensa/core/mpu.c - el \u2019hook\u2019 de arquitectura que verifica que un b\u00fafer proporcionado por el modo de usuario sea accesible para el hilo de usuario llamante con el permiso solicitado - establec\u00eda por defecto su valor de retorno en 0 (acceso permitido) y solo establec\u00eda un resultado de denegaci\u00f3n dentro de su bucle de sondeo por regi\u00f3n MPU. Cuando la extensi\u00f3n redondeada del b\u00fafer envuelve el espacio de direcciones de 32 bits (size + desplazamiento de alineaci\u00f3n cerca de SIZE_MAX, o ROUND_UP(size + offset) desbord\u00e1ndose a 0), el bucle ejecuta cero iteraciones y la funci\u00f3n devuelve 0 = permitido sin sondear ninguna regi\u00f3n MPU.\n\nLas comprobaciones previas de la capa de llamadas al sistema (K_SYSCALL_MEMORY_SIZE_CHECK / Z_DETECT_POINTER_OVERFLOW) solo detectan un \u2019wrap\u2019 de addr+size en bruto y no cubren el \u2019wrap\u2019 inducido por ROUND_UP, y la ruta de cadena (arch_user_string_nlen -> arch_buffer_validate) no tiene ninguna protecci\u00f3n a nivel de capa de llamadas al sistema.\n\nUn hilo de modo de usuario sin privilegios puede, por lo tanto, pasar un (addr, size) manipulado a cualquier llamada al sistema que valide b\u00faferes de usuario a trav\u00e9s de k_usermode_from_copy/to_copy o k_usermode_string_copy y lograr que la validaci\u00f3n tenga \u00e9xito para memoria a la que no debe acceder; el kernel entonces lee de (revelaci\u00f3n) o, con write=1, escribe en (corrupci\u00f3n) memoria del kernel o de otra partici\u00f3n elegida por el atacante en nombre del hilo, lo que permite la revelaci\u00f3n de informaci\u00f3n, la corrupci\u00f3n de memoria, la escalada de privilegios y la denegaci\u00f3n de servicio.\n\nAfectado desde la v3.7.0 (cuando se a\u00f1adi\u00f3 el soporte de espacio de usuario de Xtensa MPU) hasta la v4.4.0. La soluci\u00f3n cambia el valor predeterminado a -EINVAL (denegar por defecto), a\u00f1ade una comprobaci\u00f3n expl\u00edcita de size_add_overflow y establece el valor de \u00e9xito solo despu\u00e9s de que se haya validado el rango completo."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F648F66-9415-47A6-92AD-4C61A70269B2", "versionEndExcluding": "4.5.0", "versionStartIncluding": "3.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}