Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A vulnerability in its ext2 filesystem driver allows a specially crafted storage device (like a malicious SD card or USB drive) to crash the system or leak sensitive memory information. This occurs when the system attempts to read or list files on the untrusted media, potentially leading to a permanent device freeze or data exposure.
Technical details
An out-of-bounds read and infinite loop vulnerability exists in Zephyr's ext2 filesystem implementation within `subsys/fs/ext2/ext2_diskops.c`. The `ext2_fetch_direntry()` function fails to validate the structural relationship between the record length (`de_rec_len`), name length (`de_name_len`), and the directory block boundary. Specifically, it lacks checks to ensure `de_rec_len` is non-zero and that the entry fits within the block before performing a `memcpy` or advancing the traversal offset. An attacker with physical access can provide a crafted ext2 image that triggers an OOB read past the block buffer or a zero-progress infinite loop during directory traversal operations such as `ls`, `stat`, or `open`. Patches have been merged into the main branch and several stable branches (v4.4, v4.3).
Affected products
- Zephyr Project Zephyr OS <= 4.4
Timeline
- 2026-03-22: other: Vulnerability confirmed present in Zephyr main commit 56f8a30c
- 2026-06-21: other: Embargo date
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date