Zephyr Xtensa MPU arch_buffer_validate() Integer Overflow Vulnerability and Patch Analysis

Xtensa MPU Integer Overflow Vulnerability Vulnerability Overview In Xtensa SoCs, the function contains an integer overflow vulnerability. This function is intended to validate whether a user-supplied buffer is accessible, but it suffers from the following issues: If the extended part of the buffer ( ) causes a overflow, the loop executes zero iterations, and the function returns 0, indicating that the buffer is accessible, even though no MPU region permits access. The syscall layer pre-checks ( and ) only catch raw address and size wrapping, but do not cover wrapping caused by . Furthermore, string paths ( ) lack syscall validators. Consequently, unprotected user-mode threads can pass a forged (address, size) pair to any system call that validates user buffers via or . The validation will succeed even if the kernel should not access the buffer. The kernel then reads from (disclosure) or writes to (compromise) attacker-selected kernel or other partitioned memory, leading to information leakage, memory corruption, privilege escalation, and denial of service. Scope Affected Versions: Xtensa SoCs with and enabled, from v3.7.0 (LTS) to v4.4.0 (including v3.7.x, v4.0.0, v4.1.0, v4.2.0, v4.3.0, v4.4.0). Fixed Version: v4.5.0 Remediation Fix Status: Merged (in 303d4af), but not yet released. The expected fixed version is 4.5.0 (the fix has been merged into the main branch but has not been released; this prediction should be confirmed against the actual release). Fix Content: - Changed the default return value of from 0 (allow) to -EINVAL (deny). - Added explicit checks. - Only set the success value after the entire range has been validated. Patch Branches: main, v4.4-branch, v4.3-branch, v3.7-branch Pull Requests: #199000, #199228, #199228, #199228 Status: Merged Evidence (post-fix) — now defaults to returning -EINVAL, includes protection, and sets errno after the loop completes. — Pre-fix code had and no overflow check; a loop running zero times falls through to return 0 (permitted). — If overflows 32-bit bits, the aligned size wraps to 0. — pre-checks only catch raw address and size wrapping ( occurs before ), not the wrapping inside ; a test case with passes through both checks. — calls directly without protection; reachable via . — and copy user buffers, passing through before reaching . — calls (name, str, sizeof(name)) using attacker-controlled , reaching the unprotected string path. — The buggy default value exists in the v4.0.0 release tag. — selects MPU support, enabling (marked as experimental). Additional Information For any questions or comments, please file an issue or email the Zephyr vulnerability team. Embargo: 2026-07-14

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr Xtensa MPU arch_buffer_validate() Integer Overflow Vulnerability and Patch Analysis

More from this source