CVE-2026-10679

{"id": "CVE-2026-10679", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10679", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:32:22.710575Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "1.8.0", "lessThan": "4.3.1", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["drivers/spi/spi_dw.c", "drivers/spi/spi_dw_regs.h"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T22:17:00.177", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0", "tags": ["Patch"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3qcm-qwh2-v4hq", "tags": ["Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-369"}]}], "descriptions": [{"lang": "en", "value": "The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.\n\nspi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().\n\nOn Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.\n\nThe fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact."}, {"lang": "es", "value": "El controlador SPI DesignWare (drivers/spi/spi_dw.c) calcul\u00f3 el divisor de reloj SPI BAUDR como info -> clock_frequency / config -> frequency sin validar config -> frequency.\n\nspi_transceive es una __syscall de Zephyr y su gestor de verificaci\u00f3n (drivers/spi/spi_handlers.c) copia la spi_config proporcionada por el llamador desde el espacio de usuario sin comprobar el campo de frecuencia, por lo que un hilo del espacio de usuario al que se le ha concedido acceso a un objeto kernel de dispositivo SPI DesignWare puede pasar frequency = 0 y desencadenar una divisi\u00f3n por cero de entero sin signo en spi_dw_configure().\n\nEn Cortex-M Mainline (SCB -> CCR.DIV_0_TRP se establece en z_arm_fault_init()) y en ARC (un vector __ev_div_zero dedicado) esto provoca una excepci\u00f3n de CPU, resultando en un fallo del kernel y denegaci\u00f3n de servicio local.\n\nLa soluci\u00f3n rechaza la frecuencia cero y las frecuencias superiores a clock_frequency / 2 (el SCKDIV m\u00ednimo de 2 del manual de datos de DesignWare SSI) con -EINVAL. El defecto afecta a todas las versiones de Zephyr hasta la v4.4.0 inclusive; la explotaci\u00f3n requiere CONFIG_USERSPACE=y y un hilo sin privilegios al que ya se le haya concedido permiso de controlador SPI. No hay corrupci\u00f3n de memoria ni impacto de divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CDC8D2D-CEA6-4434-AEFD-C4DC8891730C", "versionEndIncluding": "4.4.1", "versionStartIncluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}