CVE-2026-17051— Intel SEDI IPM驱动越界写入漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是对该漏洞描述信息的中文翻译： Intel SEDI IPM（处理器间邮箱）驱动程序位于 中。该驱动在 函数中处理入站消息中断。它会读取对端写入的门铃（doorbell）寄存器，通过 提取负载长度，并将该长度直接传递给 ，以将消息复制到 中，但未将长度与缓冲区大小进行比对。门铃长度字段为 10 位宽（ 为 ），因此可编码的最大长度为 1023 字节，而 的大小仅为 （128 字节）。底层 HAL 函数 中的边界检查是一个 （调试检查），除非设置了 ，否则在编译过程中会被移除，因此在生产版本中没有任何检查机制。
影响版本矩阵 2
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| zephyrproject | zephyr | 3.5.0< 4.3.2 |
affected |
4.4.0< 4.4.2 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-17051 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
来源: CVE Program / CVE List V5
Vulnerability Description
The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the payload length with IPC_HEADER_GET_LENGTH(), and passed that length straight to sedi_ipc_read_msg() to copy the message into struct ipm_sedi_context.incoming_data_buf, without checking it against the buffer size. The doorbell length field is 10 bits wide (IPC_HEADER_LENGTH_MASK is 0x03FF), so it can encode up to 1023 bytes, while incoming_data_buf is IPC_DATA_LEN_MAX (128) bytes. The bounds check in the underlying HAL sedi_ipc_read_msg() is a DBG_CHECK that compiles away unless CONFIG_DEBUG is set, so no check remained in a production image.
The doorbell register is written by the peer processor on the other side of the IPC link — for the intel_ish_5_* targets, the host CPU's ISH driver, reached through the device's memory-mapped register window. Host-side software with driver-level or raw BAR access can therefore set a length of up to 1023 and cause the interrupt handler to copy far past the destination buffer. The affected path requires an application to have registered an IPM receive callback via ipm_register_callback(), which is the driver's normal mode of use.
The result is an out-of-bounds write of up to 895 bytes into static (.bss) memory, performed in interrupt context. The overflow first clobbers the rest of struct ipm_sedi_context — including the k_sem and k_mutex used by the transmit path, whose wait queues contain self-referential list pointers — and then adjacent static data, giving a kernel data-structure corruption and crash primitive. The overflowing bytes are read from registers following the message window, a portion of which are themselves peer-programmable. The fix rejects any doorbell whose encoded length exceeds IPC_DATA_LEN_MAX, logging it and acknowledging the doorbell so the peer is not left waiting.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.5.0 ~ 4.3.2 | - |
|
二、漏洞 CVE-2026-17051 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-17051 的情报信息
请登录查看更多情报信息。
CVE-2026-17051 补丁与修复 (1)
CVE-2026-17051 其他参考 (1)
同批安全公告 · zephyrproject · 2026-09-21 · 共 5 条
| CVE-2026-17052 | 7.8 HIGH | Tgpio_pin_read_ts_ec 用户指针校验缺失导致内存写 |
| CVE-2026-17050 | 5.7 MEDIUM | USB主机设备枚举失败双释放漏洞 |
| CVE-2026-15890 | 5.3 MEDIUM | Zephyr secure_storage ITS 非线程同步致 AEAD 重用 |
| CVE-2026-17054 | 5.3 MEDIUM | ESP SPI驱动帧重组越界读取致WiFi失效 |