CVE-2026-17052 in Zephyr
Summary
by MITRE • 09/21/2026
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded.
tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller.
The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call.
Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in the Zephyr real-time operating system stems from an incomplete validation mechanism within the Time-aware GPIO subsystem, specifically affecting the z_vrfy_tgpio_pin_read_ts_ec() syscall verification handler located in drivers/timeaware_gpio/timeaware_gpio_handlers.c. This function is responsible for mediating access to kernel resources on behalf of unprivileged user-mode threads when CONFIG_USERSPACE is enabled. While other handlers within the same module correctly implemented memory validation checks, this specific entry point failed to verify that the output pointers provided by the caller were valid and writable in supervisor mode before passing them to the underlying driver implementation. This inconsistency created a gap in the security boundary between userspace and kernelspace, allowing an attacker with access to the TGPIO device object to exploit this oversight for arbitrary memory writes.
From a technical perspective, the flaw manifests as a write-what-where primitive that crosses privilege boundaries. When an unprivileged thread invokes tgpio_pin_read_ts_ec(), it supplies pointer arguments intended to receive timestamp and event count data. The verification handler checks only the port device object but omits the mandatory K_SYSCALL_MEMORY_WRITE() check for these output pointers. Consequently, the driver function tgpio_intel_read_ts_ec() proceeds to execute two 8-byte store operations at addresses determined entirely by the user-mode caller. Although the driver performs bounds checking on the pin index, it does not validate memory safety of the destination buffers. This allows the kernel to write hardware register contents directly into arbitrary kernel memory locations chosen by the attacker, bypassing standard protection mechanisms designed to prevent such cross-privilege data corruption.
The operational impact of this vulnerability is severe, primarily due to its potential for privilege escalation and system destabilization. By corrupting critical kernel data structures through these unauthorized writes, an attacker can potentially elevate their thread's privileges from unprivileged user mode to supervisor mode, gaining full control over the operating system. Alternatively, writing invalid or malicious data to sensitive memory regions can cause immediate system crashes, leading to a denial of service condition. This vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write in terms of root cause, while its exploitation technique corresponds to ATT&CK T1055 Process Injection or more broadly to kernel-level privilege escalation techniques that leverage memory corruption primitives. The device-object permission required is narrow and not intended to confer any kernel-memory access capabilities, making this a clear violation of the principle of least privilege.
Mitigation strategies focus on correcting the code logic within the verification handler. The primary fix involves adding the missing K_SYSCALL_MEMORY_WRITE() validations for both the timestamp and event_count pointers before invoking the driver function. This ensures that the operating system verifies the caller has write access to the specified memory regions in supervisor mode, thereby preventing arbitrary kernel writes from user space. For systems already deployed with vulnerable configurations, administrators should ensure they are running patched versions of Zephyr where this validation logic is present. Additionally, developers reviewing similar syscall handlers should audit all entry points for consistent application of memory safety checks to prevent analogous gaps in other subsystems that rely on userspace interaction.
Exposure to this vulnerability is relatively narrow due to specific configuration requirements and historical build constraints. The affected code path only exists in builds where both CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y are enabled. Furthermore, a compilation breakage introduced between versions v3.6.0 and v4.4.0 regarding header relocation prevented many downstream trees from building the vulnerable file until those issues were resolved. Consequently, the exposed population is limited to specific downstream distributions that locally corrected this build failure or older builds prior to version 3.5.0 where the problematic code structure did not yet exist in its current form. This context highlights the importance of maintaining up-to-date dependency chains and verifying configuration flags when assessing risk for embedded systems utilizing Zephyr RTOS.