Executive brief
Zephyr is a real-time operating system used in embedded and IoT devices. The mailbox driver, which enables inter-process communication, contains a time-of-check/time-of-use (TOCTOU) race condition in the userspace syscall handler. An unprivileged thread can race to modify a memory pointer after the kernel validates it, causing the kernel to read from arbitrary addresses chosen by an attacker. This can leak sensitive kernel memory or crash the system.
Technical details
The vulnerability is a TOCTOU race in z_vrfy_mbox_send(), the userspace syscall verifier for the mailbox send operation. The verifier reads msg->data and msg->size directly from live userspace memory to validate bounds, then forwards the original mutable userspace struct pointer to z_impl_mbox_send() and the underlying driver. Between the validation check and the driver's use, a second thread in the same address space can race to overwrite msg->data with a supervisor (kernel-mode) address. When the driver dereferences the modified pointer (e.g., memcpy from msg->data in the NXP driver), it reads from the attacker-chosen kernel address in supervisor context. The fix copies the entire mbox_msg struct into a kernel-stack variable using k_usermode_from_copy() before validation, eliminating the race window. Attack requires CONFIG_USERSPACE enabled and ability to spawn concurrent threads; no authentication required.
Affected products
- Zephyr Project Zephyr versions prior to commit ab35eac
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: fix applied in commit ab35eaccec5976f05c196f176d0c32885754496f