CVE-2026-12235

{"id": "CVE-2026-12235", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12235", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T12:34:31.991332Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.0}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.7.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/llext/llext_link.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-12T05:17:42.277", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/106540afbd22087ad40b90f53fb22657754a719e", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xv9q-6mrf-8j49", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xv9q-6mrf-8j49", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset().\n\nrela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.\n\nThe path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.\n\nThe fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch."}, {"lang": "es", "value": "El subsistema Linkable Loadable Extensions (llext) maneja incorrectamente las entradas de reubicaci\u00f3n PLT/RELA al enlazar una extensi\u00f3n ELF reubicable (parcialmente enlazada). En llext_link_plt() (subsys/llext/llext_link.c), la rama reubicable (tgt != NULL, la ruta utilizada para objetos reubicables de Xtensa) calcul\u00f3 la direcci\u00f3n del parche como ext -> mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt -> sh_offset y luego realiz\u00f3 la escritura de reubicaci\u00f3n all\u00ed sin validar rela.r_offset. Su rama hermana compartida/din\u00e1mica ya rechazaba offsets fuera de rango a trav\u00e9s de llext_file_offset().\n\nrela.r_offset se lee directamente de la tabla RELA del ELF, por lo que una entrada manipulada con un offset mayor que la secci\u00f3n objetivo hace que la escritura caiga arbitrariamente lejos fuera del b\u00fafer de texto de la extensi\u00f3n. El resultado es una escritura fuera de l\u00edmites influenciada por el atacante (la ubicaci\u00f3n a trav\u00e9s de r_offset, el valor escrito siendo la direcci\u00f3n del s\u00edmbolo resuelto) realizada en contexto de supervisor en tiempo de enlace, antes de que se ejecute cualquier c\u00f3digo de la extensi\u00f3n.\n\nLa ruta se alcanza desde llext_load() siempre que una aplicaci\u00f3n carga una extensi\u00f3n ELF influenciada por el atacante en Xtensa con almacenamiento escribible; llext est\u00e1 documentado para aceptar extensiones de origen no confiable. El impacto es corrupci\u00f3n de memoria en contexto de supervisor (p\u00e9rdida de integridad y disponibilidad, y un escape del l\u00edmite de la sandbox para extensiones en modo usuario). La explotaci\u00f3n est\u00e1 limitada por la ruta PLT reubicable de Xtensa y el almacenamiento escribible, y convertir la escritura fuera de rango en una primitiva \u00fatil no es trivial.\n\nLa soluci\u00f3n a\u00f1ade una comprobaci\u00f3n de l\u00edmites que rechaza cualquier entrada RELA cuyo r_offset >= tgt -> sh_size, reflejando la validaci\u00f3n existente en la rama compartida."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}