CVE-2026-79978— ADXL345 驱动 RTIO 流读取越界写漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 中，RTIO 流式传输完成回调函数 会将要报告的 FIFO 数据量限制为 实际返回的空间（即 ）。然而，随后该函数却依据设备报告的条目数量（而非上述限制值），从 开始，以连续偏移量对每个硬件 FIFO 条目发起一次 6 字节的总线读取。当已分配缓冲区小于完整批次大小时，驱动程序会向分配区域末尾之后最多 186 字节处写入数据。此外，还存在一个关联缺陷： 在批次开始时未被重置，因此若某条数据链被中止或出错，可能残留一个旧的写入偏移量，导致下一批次的写入同样越界。 短缓冲区是 RTIO 分配器的预期且一等公民式的结
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-79978 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
来源: CVE Program / CVE List V5
Vulnerability Description
The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffer is smaller than a full batch, the driver writes up to 186 bytes past the end of the allocation; a companion defect left data->fifo_total_bytes un-reset at batch start, so an aborted or errored chain could leave a stale write offset that pushes the next batch's writes out of bounds as well.
A short buffer is an expected, first-class outcome of the RTIO allocator: rtio_block_pool_alloc() walks the requested size down one block at a time until a contiguous run is available, and the driver only demands sizeof(struct adxl345_fifo_data) + 6 bytes as its minimum. Any streaming configuration whose mempool block granularity is smaller than a full FIFO batch (204 bytes) — for example the sensor shell's RTIO_DEFINE_WITH_MEMPOOL(sensor_read_rtio, 8, 8, 32, 64, 4) used by sensor stream <dev> on fifo_wm incl, or the 16-byte-block streaming example in the documentation — takes this path whenever the pool is fragmented or the consuming thread falls behind.
The out-of-bounds writes are performed by the I2C/SPI RTIO backend (DMA on many SoCs) into the shared RTIO block pool, corrupting neighbouring live buffers or, for a pool smaller than one batch, memory beyond the pool itself. The written bytes are accelerometer samples and the destination follows the allocation, so there is no controllable corruption primitive: the realistic impact is silent corruption of other RTIO consumers' data or a crash. Reaching it requires a board with an interrupt-wired ADXL345 built with CONFIG_ADXL345_STREAM, plus buffer-pool starvation, which a co-resident local workload can induce but which also occurs spontaneously under load; there is no network, USB or radio path to this code.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.0.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-79978 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-79978 的情报信息
请登录查看更多情报信息。
CVE-2026-79978 厂商安全公告 (1)
CVE-2026-79978 其他参考 (1)
同批安全公告 · zephyrproject · 2026-10-23 · 共 7 条
| CVE-2026-79982 | 8.8 HIGH | USB 蓝牙 HCI 传输越界写入漏洞 |
| CVE-2026-79977 | 8.2 HIGH | Zephyr WireGuard 远程隧道劫持漏洞 |
| CVE-2026-79979 | 7.8 HIGH | ARM64 用户线程访问重用物理帧漏洞 |
| CVE-2026-19741 | 7.5 HIGH | OpenThread 默认 PSKd 凭证泄露漏洞 |
| CVE-2026-79981 | 6.5 MEDIUM | DNS 解析器 UDP 源端口复用漏洞 |
| CVE-2026-79980 | 5.6 MEDIUM | DHCPv4 可预测事务 ID 导致网关和 DNS 被篡改漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-79978
暂无评论