CVE-2026-14986— I2C目标FIFO中断处理越界写漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
ITE it51xxx I2C 驱动在作为 I2C 从机（target）且启用缓冲区模式（CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE）时，在其目标 FIFO 中断处理函数 （位于 ）中，会将主机提供的写入数据复制到固定大小的 中。该复制循环向 写入数据，并且只有在写入完成后才检查 是否超出 ，因此该边界检查无法防止缓冲区溢出。 运行索引 会在每次正在进行的传输中的 FIFO 填充中断中累加 个字节，并仅在遇到 STOP 条件或超时情况时重置为零。如果 I2C
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-14986 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction
来源: CVE Program / CVE List V5
Vulnerability Description
The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow.
The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data.
The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.2.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-14986 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-14986 的情报信息
请登录查看更多情报信息。
CVE-2026-14986 其他参考 (2)
同批安全公告 · zephyrproject · 2026-09-14 · 共 6 条
| CVE-2026-16147 | 6.8 MEDIUM | it82xx2 USB 控制器释放后使用及事件列表损坏 |
| CVE-2026-15893 | 6.5 MEDIUM | Zephyr IPv6邻居发现协议路由通告触发拒绝服务漏洞 |
| CVE-2026-15924 | 5.9 MEDIUM | Zephyr 套接字TLS会话缓存并发访问UAF漏洞 |
| CVE-2026-15923 | 4.6 MEDIUM | Zephyr 文件系统 SDIO 拒绝服务漏洞 |
| CVE-2026-16148 | 4.6 MEDIUM | it82xx2驱动致内核恐慌 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-14986
暂无评论