Executive brief
A vulnerability in the Zephyr operating system's I2C driver can allow a hardware device on the same physical bus to disable communication with the affected system. By sending specific, valid I2C sequences or causing minor electrical glitches, an attacker can cause the driver to enter a permanent 'stuck' state. This results in a denial of service where the system can no longer receive data from the I2C bus until it is manually reset.
Technical details
A logic error exists in the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) when operating in target/slave mode. The `rx_full` interrupt handler gates the `write_requested()` callback based on the driver state, but the state is only reset to `READY` upon receiving a `STOP` interrupt. Because the `START_DET` interrupt was omitted from the enabled interrupt mask in `i2c_dw_slave_register()`, the driver cannot recover its state if a `STOP` interrupt is missed or if a master issues a legal 'WRITE-repeated-START-WRITE' sequence. An attacker with physical access to the I2C bus can exploit this to permanently wedge the driver in a `CMD_SEND` state, preventing further write transactions. The issue is resolved by unmasking the `START_DET` interrupt to ensure state resets on every bus (re)START.
Affected products
- Zephyr Project Zephyr OS >= 4.0.0, < 4.5.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched