Executive brief
A logging system in Zephyr OS, used in embedded and IoT devices, fails to validate arguments passed from user-mode applications to the kernel. An attacker can trigger the kernel to read from arbitrary memory addresses and leak sensitive kernel data, or cause the kernel to crash. This bypasses the security boundary between user-mode and kernel-mode isolation.
Technical details
The vulnerability is a missing kernel parameter validation in the z_vrfy_z_log_msg_static_create() system-call verifier (subsys/logging/log_msg.c). The verifier acts as a pure pass-through without performing K_SYSCALL_* validation checks, allowing unprivileged user-mode threads to invoke z_log_msg_static_create() with fully attacker-controlled arguments. The kernel-mode handler then dereferences these untrusted pointers—reading from memory via source, package, and data arguments—without bounds checking. An attacker can supply arbitrary kernel addresses and lengths to leak kernel memory or trigger a kernel panic. The fix adds K_SYSCALL_MEMORY_READ() validation and bounds checks against Z_LOG_MSG_MAX_PACKAGE. No memory corruption or write primitive is possible.
Affected products
- Zephyr Project Zephyr OS unknown
Timeline
- 2026-08-14: disclosed
- 2026-08-14: advisory: CVE-2026-12364