Executive brief
A vulnerability exists in the Microchip SERCOM-G1 UART driver used by certain Zephyr-based hardware. When the system is configured to use a specific high-speed data transfer mode (DMA) with a very small one-byte buffer, an attacker with physical or local network access to the serial port can cause the system to write data outside of its intended memory area. This could lead to a system crash or unpredictable behavior, potentially disrupting the device's operations.
Technical details
An out-of-bounds write (CWE-787) exists in the Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c) used by the PIC32CM-JH SoC family. The issue occurs in the asynchronous (DMA) receive path when uart_rx_enable() is called with a buffer length of one (len == 1) while CONFIG_UART_MCHP_ASYNC is enabled. Due to the SoC's peripheral-triggered DMA start sequencing, a single-beat DMA transfer is initiated while a byte is already pending in the DATA register, causing a one-byte write past the end of the provided buffer. This results in single-byte memory corruption adjacent to the RX buffer. The vulnerability is fixed by manually reading the first byte with the CPU and adjusting DMA sizing for subsequent bytes.
Affected products
- Zephyr Project Zephyr RTOS 4.4.0
Timeline
- 2026-04-21: patched: Fix merged into main branch via commit 5251d2b
- 2026-06-28: advisory: GHSA-xv2x-56j7-6wc3 published
- 2026-06-28: disclosed: CVE-2026-10644 published