Executive brief
The Intel ALH digital-audio-interface driver in Zephyr RTOS contains a vulnerability in its dai_alh_get_properties() function that fails to validate user-supplied stream identifiers. A local user with device access can exploit this to read sensitive kernel memory one byte at a time, potentially leaking kernel addresses, or trigger denial of service by causing kernel page faults. The vulnerability requires user-mode execution support but has moderate severity due to the limited information disclosure scope.
Technical details
The vulnerability is an out-of-bounds read in the dai_alh_get_properties() function (drivers/dai/intel/alh/alh.c), which uses a caller-supplied stream_id parameter to index a fixed-size 64-byte array (alh_handshake_map) and compute FIFO register offsets without range validation. An attacker calling the dai_get_properties_copy() Zephyr __syscall with an out-of-range stream_id can read arbitrary kernel memory at a signed offset from the array, with the leaked byte copied back to userspace via the dai_properties struct. The syscall's verifier (z_vrfy_dai_get_properties_copy()) validates device permissions and buffer destination but not stream_id. Exploitation is local, requires CONFIG_USERSPACE enabled and ALH DAI device access, and can also trigger kernel-context page faults for denial of service. The fix validates stream_id range and rejects invalid values, mapping to -ENOENT on syscall return.
Affected products
- Zephyr Project Zephyr RTOS versions prior to commit b470bfc
Timeline
- 2026-08-12: disclosed: CVE-2026-12232 published
- 2026-08-12: patched: Fix committed (b470bfc) to validate stream_id range