Executive brief
The Zephyr embedded operating system's ext2 filesystem driver does not properly validate a critical filesystem parameter (s_log_block_size) when mounting a storage device. An attacker can craft a malicious ext2 image—such as on a removable SD card—that causes the kernel to write data outside its allocated memory buffers, potentially crashing the device or executing arbitrary code with kernel privileges.
Technical details
The vulnerability is a missing input validation flaw in the ext2 filesystem driver's superblock verification routine (ext2_verify_disk_superblock). The s_log_block_size field, read directly from an attacker-controlled image, is used in an unvalidated left shift operation (1024 << s_log_block_size) to compute the filesystem block size. An oversized value either causes integer overflow (undefined behavior) or produces a block size exceeding the configured limit. The derived block size is passed to k_mem_slab_init() without bounds checking, causing the memory allocator to lay out slab structures past the end of the fixed static buffer. Subsequent block reads then perform out-of-bounds writes into adjacent kernel memory. The attack requires only the ability to present a crafted ext2 image to the device (e.g., via SD card); no authentication or privilege is needed. The fix validates that s_log_block_size is at most 11 and that the resulting block size does not exceed CONFIG_EXT2_MAX_BLOCK_SIZE.
Affected products
- Zephyr Project Zephyr <unknown>
Timeline
- 2026-08-25: disclosed