CVE-2026-13216— Zephyr virtio PCI驱动越界栈写入漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
virtio PCI 驱动程序（drivers/virtio/virtio_pci.c）在驱动初始化期间会解析设备的 PCI 能力列表。在 函数中，设备提供的能力长度字节 （通过 从 PCI 配置空间读取）仅使用 进行检查。该断言在启用 时才会生效，而在生产构建中默认关闭，因此该值在到达复制逻辑时完全未经验证。 该长度随后用于驱动一个循环，将额外的能力双字（dwords）复制到调用者提供的固定大小栈缓冲区中。如果 小于基础结构体 的 24 字节，会导致无符号变量 发生下溢，接近 ，从而产生近乎无限的栈写入；如果 超
影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| zephyrproject | zephyr | 4.2.0< 4.4.2 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-13216 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length
来源: CVE Program / CVE List V5
Vulnerability Description
The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-supplied capability length byte cap_len (read from PCI config space via pcie_conf_read()) was only checked with assert(tmp.cap_len == cap_struct_size). That assert resolves to __ASSERT_NO_MSG(), gated by CONFIG_ASSERT, which defaults off in production builds, so the value reached the copy logic completely unvalidated.
The length then drives a loop that copies extra capability dwords into a fixed-size stack buffer supplied by the caller. A cap_len below the 24-byte base struct virtio_pci_cap underflows the unsigned extra_data_words count to a near-SIZE_MAX value, producing an effectively unbounded stack write; a cap_len above the caller's buffer (up to 255) writes up to roughly 228 bytes of device-controlled data past the buffer. Both are out-of-bounds writes of attacker-controlled content executed in kernel mode during boot-time device probe.
The input originates from the virtio device. In the common deployment where Zephyr runs as a guest under a hypervisor, the device backend is the host, which already fully outranks the guest, so the bug yields no privilege escalation. The exploitable case is a virtio device that is untrusted relative to the Zephyr kernel — an untrusted or physical/passthrough virtio PCIe device on a bare-metal system, or a confidential-computing posture where the guest must defend against the host — where a malicious device can corrupt the kernel stack and potentially achieve code execution or a crash.
The fix replaces the compiled-out assert with a runtime range check rejecting cap_len outside [sizeof(struct virtio_pci_cap), cap_struct_size] before any arithmetic or copy.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.2.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-13216 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-13216 的情报信息
请登录查看更多情报信息。
CVE-2026-13216 补丁与修复 (1)
CVE-2026-13216 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-08-25 · 共 5 条
| CVE-2026-13214 | 9.8 CRITICAL | OCPP GetConfiguration密钥解析栈缓冲区溢出漏洞 |
| CVE-2026-13215 | 6.8 MEDIUM | Zephyr ext2挂载未验证块大小导致越界写入漏洞 |
| CVE-2026-13217 | 5.9 MEDIUM | Zephyr OCPP CALLRESULT解析空指针解引用漏洞 |
| CVE-2026-13478 | 5.5 MEDIUM | Zephyr ext2 块位图验证越界读取漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-13216
暂无评论