Executive brief
Zephyr RTOS is a real-time operating system used in embedded and IoT devices. A flaw in the Time-aware GPIO driver's syscall handler allows an unprivileged user-mode thread with GPIO device access to write arbitrary data to kernel memory addresses, potentially escalating privileges or crashing the system. This requires enabling specific build options (CONFIG_USERSPACE and CONFIG_TIMEAWARE_GPIO) and affects only certain versions where build breakage was locally corrected or in v3.5.0 and earlier.
Technical details
The z_vrfy_tgpio_pin_read_ts_ec() syscall handler in drivers/timeaware_gpio/timeaware_gpio_handlers.c fails to validate output pointer parameters with K_SYSCALL_MEMORY_WRITE(), unlike similar handlers in the same file. This allows a user-mode caller with TGPIO device access to supply arbitrary kernel addresses, which are then written to by tgpio_intel_read_ts_ec() in the driver, creating a write-what-where primitive. The attack requires CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y; exposure is narrowed to v3.5.0, downstream trees that locally fixed build breakage, and is absent from v4.4.0 onward unless affected builds were locally patched.
Affected products
- Zephyr RTOS v3.5.0 and earlier; v3.6.0 to v4.4.0 (with local build fixes); potentially affected versions post-v4.4.0 if locally corrected
Timeline
- 2026-09-21: disclosed
- 2026-09-21: advisory