Zephyr PL011 UART Driver DoS via Infinite Loop in TX IRQ Enable

Vulnerability Overview A non-terminating software loop exists in the Zephyr PL011 UART driver ( ). This loop repeatedly invokes the interrupt-driven application callback within until the TX interrupt mask ( ) is set, aiming to handle the transition of TX interrupt behavior at the controller level. When CTS hardware flow control is enabled (via or runtime ) and the serial port has a disconnected CTS line, the controller stops reading data from the TX FIFO ( ). Consequently, it returns 0 for each callback, while the application still has data pending transmission. As a result, the TX interrupt is never disabled. The loop condition is unclear, causing the thread invoking (e.g., in the Bluetooth HCI H4 driver) to hang indefinitely. The execution context becomes stuck, leading to a Denial of Service (CWE-835). An attacker can exploit this vulnerability by controlling the CTS line connected to the UART and triggering a hang via blocking TX interrupts. Since the peer is a device connected to the UART, this could be a removable or external module (e.g., an onboard Bluetooth controller over the HCI H4 link) rather than a component permanently fixed on the PCB; thus, the attack vector is classified as Adjacent (AV:A) rather than Physical. Security submitter advises considering the specific deployment context of the peer. The impact is limited to availability; there are no consequences for memory safety, confidentiality, or integrity. Affected Versions Affected Versions: v4.1.0 through v4.4.0 (the loop exists in v4.1.0, v4.2.0, v4.2.1, v4.2.2, v4.3.0, and v4.4.0) Fixed Versions: 4.5.0 Remediation Fix Status: Fixed (merged silently) in PR #107822 Expected Fix Version: 4.5.0 (The fix has been merged into but has not yet been released; this estimate should be confirmed based on the actual release schedule.) Introduced By: Replaced by commit b783bc8 (drivers: serial: pl011: fix missing TX callback with FIFO enable, 2025-02-10), which addressed the issue by replacing the single callback call with a bounded loop. Patches Additional Information If you have any questions or comments, please contact us via the following channels: Open an issue in the Zephyr repository Contact us through the Zephyr vulnerability reporting channel Embargo: 2026-06-17

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr PL011 UART Driver DoS via Infinite Loop in TX IRQ Enable

More from this source