FKIE_CVE-2026-11743

Vulnerability from fkie_nvd - Published: 2026-08-07 22:16 - Updated: 2026-11-04 05:18
Severity
6.6 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Summary
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not. In builds with CONFIG_USERSPACE, flash_read and flash_write are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access. The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread. The fix replaces the check with qspi_nor_range_is_valid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.
References
vulnerabilities@zephyrproject.orghttps://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae
vulnerabilities@zephyrproject.orghttps://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c6wh-gwg4-fj5j
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "drivers/flash/flash_sf32lb_mpi_qspi_nor.c"
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.3.2",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.4.2",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "vulnerabilities@zephyrproject.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) \u003e data-\u003esize. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data-\u003ebase + offset), size) and the write path programs flash at offset and cache-invalidates data-\u003ebase + offset, in both cases accessing memory outside the mapped flash window. The driver\u0027s erase path already rejected negative offsets, but read and write did not.\n\nIn builds with CONFIG_USERSPACE, flash_read and flash_write are syscalls whose verifiers validate the device object and the caller\u0027s buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access.\n\nThe most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread.\n\nThe fix replaces the check with qspi_nor_range_is_valid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition."
    },
    {
      "lang": "es",
      "value": "El controlador de flash SF32LB MPI QSPI NOR (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validaba el desplazamiento y la longitud del flash en sus rutas de lectura y escritura con la prueba (offset + size) \u003e data  -\u003e  size. Debido a que \u2019offset\u2019 es un \u2019off_t\u2019 con signo mientras que \u2019size\u2019 no tiene signo, un desplazamiento negativo se convierte en un valor grande sin signo y la adici\u00f3n puede desbordarse a un resultado peque\u00f1o que pasa la verificaci\u00f3n. La ruta de lectura luego realiza memcpy(dst, (void *)(data  -\u003e  base + offset), size) y la ruta de escritura programa el flash en el desplazamiento e invalida la cach\u00e9 de data  -\u003e  base + offset, en ambos casos, accediendo a memoria fuera de la ventana de flash mapeada. La ruta de borrado del controlador ya rechazaba los desplazamientos negativos, pero lectura y escritura no lo hac\u00edan.\n\nEn compilaciones con CONFIG_USERSPACE, flash_read y flash_write son llamadas al sistema (syscalls) cuyos verificadores validan el objeto del dispositivo y el b\u00fafer del llamador, pero delegan deliberadamente la verificaci\u00f3n de l\u00edmites de desplazamiento al controlador. Un hilo sin privilegios al que se le ha concedido acceso a este dispositivo flash puede, por lo tanto, llamar a la llamada al sistema con un desplazamiento negativo manipulado y un b\u00fafer v\u00e1lido en su propio dominio de memoria, y alcanzar el acceso no verificado.\n\nEl impacto m\u00e1s directo est\u00e1 en la ruta de lectura: al elegir un desplazamiento negativo y un tama\u00f1o coincidente, un atacante desliza el origen de memcpy por debajo de la base del flash y copia memoria arbitraria direccionable por la CPU en su propio b\u00fafer, revelando memoria que no est\u00e1 autorizado a leer. La ruta de escritura permite adicionalmente programar el flash en una direcci\u00f3n fuera de rango e invalidar un rango de cach\u00e9 elegido por el atacante, afectando la integridad y la disponibilidad. La alcanzabilidad requiere que el espacio de usuario (userspace) est\u00e9 habilitado y que el objeto del dispositivo flash en bruto se conceda a un hilo no confiable.\n\nLa soluci\u00f3n reemplaza la verificaci\u00f3n con qspi_nor_range_is_valid(), que rechaza los desplazamientos negativos y realiza la comparaci\u00f3n de l\u00edmites en aritm\u00e9tica de 64 bits segura contra desbordamientos en ambas rutas, y adicionalmente a\u00f1ade un b\u00fafer de rebote DMA SRAM m\u00e1s el rechazo de superposici\u00f3n de origen/destino para prevenir una condici\u00f3n separada de bloqueo del bus DMA."
    }
  ],
  "id": "CVE-2026-11743",
  "lastModified": "2026-11-04T05:18:29.807",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.7,
        "source": "vulnerabilities@zephyrproject.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11743",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-10T16:43:11.668749Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T22:16:57.317",
  "references": [
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/909eb568750304d68ea481d1b56a489ae670bdae"
    },
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c6wh-gwg4-fj5j"
    }
  ],
  "sourceIdentifier": "vulnerabilities@zephyrproject.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "vulnerabilities@zephyrproject.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.