Executive brief
The Zephyr RTOS ext2 filesystem driver contains a flaw in how it validates disk metadata during mount. A crafted ext2 disk image with an oversized block count can cause the driver to read hundreds of megabytes past the allocated bitmap buffer, triggering a memory access fault and crashing the system. An attacker with the ability to mount untrusted storage media (USB drives, SD cards, or downloaded disk images) can exploit this to deny service.
Technical details
The vulnerability is a bounds-check bypass in the ext2 filesystem driver's ext2_init_fs() function. The driver reads the block count (s_blocks_count) and first data block offset (s_first_data_block) from the disk superblock without validating them against the actual bitmap buffer capacity. When ext2_bitmap_count_set() is called with an oversized block count (up to ~4 billion bits), it attempts to read bitmap data far beyond the single allocated block buffer (~4096 bytes, holding max 32768 bits), resulting in an out-of-bounds read of ~512 MB. The defect is triggered during filesystem mount before any user data access. While the over-read does not leak attacker-controlled data to userspace, the memory fault will almost certainly cross an unmapped or MPU-protected boundary, crashing the kernel. Patches should validate that fs_blocks does not exceed the bitmap buffer capacity (fs->block_size * 8) before scanning.
Affected products
- Zephyr Zephyr RTOS unspecified
Timeline
- 2026-08-25: disclosed
- 2026-08-25: advisory