CVE-2026-11743 in Zephyr
Summary
by MITRE • 08/08/2026
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed off_t while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void *)(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not.
In builds with CONFIG_USERSPACE, flash_read and flash_write are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access.
The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread.
The fix replaces the check with qspi_nor_range_is_valid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
The vulnerability exists within the SF32LB MPI QSPI NOR flash driver implementation where improper validation of flash offset parameters creates a critical security flaw. This issue stems from a fundamental type mismatch in the boundary checking logic, specifically when validating read and write operations. The driver employs a comparison test (offset + size) > data->size to determine if an access operation is valid, but this approach fails due to the differing data types of offset and size parameters. When offset is a signed off_t type and size is unsigned, negative offset values undergo implicit conversion to large unsigned integers, causing arithmetic overflow that can result in a small sum that incorrectly passes validation checks.
The operational impact of this vulnerability manifests through two distinct attack vectors within the driver's read and write paths. During read operations, the vulnerable code executes memcpy(dst, (void *)(data->base + offset), size) which accesses memory locations outside the intended flash mapping window when negative offsets are used. Similarly, the write path performs flash programming at attacker-controlled addresses and cache invalidation on arbitrary memory ranges, creating potential for both information disclosure and system integrity compromise. While the erase path properly rejects negative offsets, the read and write functions lack this crucial validation, creating an asymmetric security posture.
The vulnerability becomes exploitable when the system operates with CONFIG_USERSPACE enabled and unprivileged threads are granted access to the flash device object through proper permissions. Under these conditions, an untrusted thread can make syscalls to flash_read and flash_write with crafted negative offset parameters, bypassing the kernel's memory protection mechanisms that would normally prevent such operations. This scenario allows attackers to slide memory access pointers below the valid flash base address during read operations, enabling them to copy unauthorized CPU-accessible memory contents into their own buffers. The write path amplifies this threat by permitting programming of flash at out-of-bounds addresses and cache invalidation of attacker-controlled memory regions.
This vulnerability aligns with CWE-191, Integer Underflow (Wrap or Wraparound), and CWE-129, Improper Validation of Array Index, while also presenting characteristics that map to ATT&CK techniques involving privilege escalation and information gathering. The specific implementation flaw demonstrates a classic buffer overflow pattern where signed-unsigned arithmetic interactions create unexpected behavior in boundary validation logic. The attack requires an attacker to have access to the flash device through userspace permissions, making it a privilege-based vulnerability rather than one exploitable from arbitrary contexts.
The remediation strategy addresses multiple aspects of this vulnerability by implementing a comprehensive range validation approach. The fix replaces the problematic offset validation with qspi_nor_range_is_valid(), which explicitly rejects negative offsets and performs all boundary comparisons using safe 64-bit arithmetic to prevent overflow conditions. Additionally, the solution incorporates a SRAM DMA bounce buffer mechanism along with source/destination overlap rejection logic to prevent potential DMA bus-hang conditions that could occur during the memory operations. This comprehensive approach not only fixes the immediate validation issue but also addresses secondary concerns related to DMA operation safety and system stability while maintaining compatibility with existing flash driver functionality.
The root cause analysis reveals a fundamental design flaw in how signed and unsigned integer types interact within boundary checking logic, demonstrating the importance of careful type handling in security-critical code sections. This vulnerability underscores the necessity for thorough testing of arithmetic operations involving different data types, particularly when dealing with memory addresses and buffer boundaries. The fix ensures that all flash access operations maintain consistent validation semantics while providing robust protection against both integer overflow conditions and DMA-related system stability issues.