CVE-2026-9728

{"id": "CVE-2026-9728", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9728", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:06:27.362976Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.1}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["drivers/mbox/mbox_handlers.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T15:16:49.010", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.\n\nOn a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).\n\nThe impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race."}, {"lang": "es", "value": "El verificador de llamadas al sistema de espacio de usuario z_vrfy_mbox_send() en drivers/mbox/mbox_handlers.c valid\u00f3 los campos anidados msg -> data/msg -> size ley\u00e9ndolos directamente de la memoria activa del espacio de usuario, y luego reenvi\u00f3 el puntero original, a\u00fan mutable, de la estructura mbox_msg * del espacio de usuario a z_impl_mbox_send() y al controlador subyacente. Entre la verificaci\u00f3n de acceso y el uso de msg -> data por parte del controlador, el puntero validado podr\u00eda ser reemplazado, dejando una ventana de tiempo de verificaci\u00f3n/tiempo de uso.\n\nEn un sistema construido con CONFIG_USERSPACE, cualquier hilo de espacio de usuario sin privilegios puede invocar la llamada al sistema mbox_send(). Un segundo hilo que comparte el espacio de direcciones del llamante puede competir para sobrescribir msg -> data con una direcci\u00f3n de supervisor (kernel) despu\u00e9s de que la verificaci\u00f3n de l\u00edmites del verificador haya pasado pero antes de que el controlador lo desreferencie. El controlador luego lee de la direcci\u00f3n elegida por el atacante en contexto de supervisor (por ejemplo, memcpy(&data32, msg -> data, msg -> size) en el controlador de buz\u00f3n NXP, cuyos bytes se emiten posteriormente al punto final del buz\u00f3n par).\n\nEl impacto es una omisi\u00f3n de control de acceso de espacio de usuario a supervisor: divulgaci\u00f3n de contenidos de memoria del kernel (alto impacto en la confidencialidad), o, para una direcci\u00f3n de destino inv\u00e1lida/no mapeada, una lectura de kernel con fallo que causa denegaci\u00f3n de servicio. La soluci\u00f3n captura la estructura mbox_msg completa en una copia de pila del kernel con k_usermode_from_copy() y valida y reenv\u00eda esa copia inmutable, cerrando la condici\u00f3n de carrera."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}