Zephyr: Out-of-bounds kernel memory read and write via signed offset in simulated EEPROM driver
Summary
The simulated EEPROM driver in Zephyr validates access ranges with an unsigned-overflow-prone check that accepts negative offsets. A local user-mode thread with access to a simulated EEPROM device can supply a crafted offset and length, so the kernel reads and writes memory before the driver's static buffer. This can corrupt adjacent kernel state and escape user-mode isolation. Exposure is limited to builds that include the simulated EEPROM driver together with userspace isolation.
Affected
- Zephyr >= 2.2.0, < 4.3.2
- Zephyr >= 4.4.0, < 4.5.0
- Only builds with CONFIG_EEPROM_SIMULATOR and CONFIG_USERSPACE enabled and the device granted to user threads
Fixed in
- Zephyr 4.3.2
- Zephyr 4.5.0
- Fix commit ce2ec9b; a backport to the v3.7 branch exists, but no confirmed release number is known.
Workaround
- Disable the simulated EEPROM driver in production builds.
- Do not grant the simulated EEPROM device object to user threads.
- No vendor workaround known.
Exploitation
- Known exploitation in the wild: none known according to OffSeq.
- Public proof of concept: none found.
- The fix diff is public (upstream issue #119410 and merged fix PR), so the flaw should be treated as an n-day.
- CISA KEV status: unknown.
Our recommendation
- Check whether your firmware uses Zephyr and whether it is built with the simulated EEPROM driver and userspace enabled.
- Ask device and firmware suppliers whether they ship Zephyr 4.3.2, 4.5.0 or later.
- Upgrade in-house firmware builds to a fixed release or apply commit ce2ec9b.
- Disable the simulator driver in production builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zephyr fix commit ce2ec9b github.com
- Zephyr security advisory GHSA-vf6j-hcx8-44vh github.com
- Zephyr 4.3.2 release github.com
- Zephyr issue 119410 github.com
- Zephyr backport PR 119416 github.com
- OffSeq threat radar radar.offseq.com
- VulDB entry 435166 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:01.
Original description (NVD)
The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a single test, (offset + len) <= config->size. Because offset is a signed off_t and len an unsigned size_t of the same rank, the addition is evaluated in unsigned arithmetic: a negative offset combined with a compensating len wraps the sum back into the accepted range. eeprom_sim_read() and eeprom_sim_write() then memcpy() through the EEPROM(addr) macro, which is plain pointer arithmetic on the driver's static mock_eeprom array, so the copy addresses memory located before that array. eeprom_read() and eeprom_write() are __syscall entry points, and their verification handlers in drivers/eeprom/eeprom_handlers.c check only the device object and the caller's own data buffer (K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE) — the offset argument is passed to the driver unvalidated. With CONFIG_USERSPACE=y, a CONFIG_EEPROM_SIMULATOR device instance, and the device object granted to a user thread (the usage the in-tree tests/drivers/eeprom/api suite exercises from ZTEST_USER threads), an unprivileged thread could supply a negative offset and have the kernel perform the copy on its behalf. The result is an out-of-bounds read of kernel .bss returned into the caller's buffer and, via the write path, an out-of-bounds write of caller-supplied bytes over kernel memory preceding mock_eeprom. Both the start address and the length of the affected span are attacker-selected, so the primitive is sufficient to corrupt adjacent kernel state and escape the user-mode sandbox. Exposure is limited to builds that instantiate the simulated EEPROM (status = "okay" by default on qemu_x86 and native_sim, otherwise added by a devicetree overlay) together with userspace isolation. The fix rejects negative offsets and performs the remaining bound check without overflow.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.