Executive brief
The Intel SEDI inter-processor mailbox driver in Zephyr RTOS fails to validate message length from a peer processor before copying into a fixed-size buffer, allowing an out-of-bounds write. An attacker with host-level driver or raw memory access can trigger the vulnerability to corrupt kernel data structures, cause crashes, or potentially achieve code execution in the ISH (Integrated Sensor Hub) firmware.
Technical details
The vulnerability is an out-of-bounds write in ipm_event_dispose() triggered by insufficient bounds checking on a 10-bit length field (0–1023 bytes) from a peer-programmable doorbell register, copied into a 128-byte buffer without validation. The underlying HAL bounds check only exists in debug builds (CONFIG_DEBUG), leaving production images unprotected. An attacker can write up to 895 bytes past the destination buffer into static kernel data, corrupting synchronization primitives (k_sem, k_mutex) and adjacent memory, leading to data structure corruption and kernel crash.
Affected products
- Intel SEDI IPM driver versions prior to the 2026-09-21 fix
Timeline
- 2026-09-21: disclosed