Zephyr OS recvmsg() out-of-bounds write vulnerability analysis and fix

Vulnerability Overview The implementation for IP sockets in Zephyr ( in ) validates the user-provided ancillary data ( ) buffer but only checks the payload length ( ) when writing a complete control message, which includes an aligned header plus the payload. Because the check ignores the size of the , the control buffer length falls within an unchecked window (e.g., 16–27 bytes for IPv4 with ). On 64-bit targets, a single element actually occupies 28 bytes, leading to a fixed-size out-of-bounds write of up to one header (~12 bytes) beyond the end of the buffer. Under , the verifier allocates a kernel heap control buffer of size and executes the implementation on it. Consequently, the overflow overwrites kernel heap memory, and it can be triggered by a non-privileged user-space thread. In supervisor mode, this corrupts the caller's buffer. This path is reachable on UDP/IP sockets with / (or ) enabled, when an application calls . If the control buffer is insufficient and a datagram is received, the partially overwritten bytes (specifically the destination IP in ) are influenced by the received packet. The fix ensures the capacity check uses (aligned header + aligned data) and returns when the buffer is too small. The affected versions are v3.6.0 through v4.4.0. Affected Components Affected Component: Affected Versions: v3.6.0 to v4.4.0 (current latest version; / / matched against socket options) Remediation Status: Fixed in (silently merged). Expected Fixed Version: 4.5.0 (the fix has been merged into but not yet released; this prediction should be confirmed against the actual release). Commit Introducing the Fix: net: socket: Add support for filling receive pktinfo data (2023-11-27; later relocated by ) Evidence (post-fix) — The capacity check now uses ; the previous revision only checked , omitting the header. — Writes the header, then copies into , creating an aligned spanning header + payload (28 bytes for IPv4 PKTINFO). — requires (16); = aligned header + aligned data; = aligned header + data — establishing a [16, 27] overflow window. — allocates the kernel heap via and runs the , so the OOB write hits the kernel heap; copy-back is limited by (no copy-back overflow). — only checks and before ; there is no full-space protection externally; gating is added via . and — The vulnerability check was introduced in v3.6.0 and still exists in v4.4.0 (reportable). Patches Fix 1 — #106464 Fix 2 — #110780 Additional Information If you have any questions or comments regarding this advisory: Open an issue in . Contact us via . Embargo: 2026-06-19

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr OS recvmsg() out-of-bounds write vulnerability analysis and fix

More from this source