{"schema":"threatline.record/2","record":{"id":"CVE-2026-19595","aliases":["GHSA-7337-mc44-5wjm"],"summary":"Zephyr RTIO syscall verifier validates output parameters for read instead of write access","details":"The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread.\n\nAn unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invoke the rtio_cqe_get_mempool_buffer() syscall with buff/buff_len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO_CQE_FLAG_MEMPOOL_BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG_USERSPACE together with CONFIG_RTIO_SYS_MEM_BLOCKS, the configuration behind RTIO_DEFINE_WITH_MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing.\n\nTwo outcomes follow. If the target lies in a memory-domain partition declared K_MEM_PARTITION_P_RW_U_RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z_fatal_error() and the default k_sys_fatal_error_handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service.\n\nThe read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE(), so a thread lacking write permission is terminated by K_OOPS before the implementation runs; the cqe argument correctly remains read-validated.","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19595","source_modified_at":"2026-10-20T19:21:46.367Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"zephyr","vendor":"zephyrproject","versions":[{"lessThanOrEqual":"4.4.2","status":"affected","version":"3.4.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7337-mc44-5wjm","source_modified_at":"2026-10-19T20:52:15Z","fetched_at":"2026-10-23T20:39:26.410340Z","package":{"ecosystem":"other","name":"zephyr"},"range":">= 3.4.0, <= 4.4.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7337-mc44-5wjm","source_modified_at":"2026-10-19T20:52:15Z","fetched_at":"2026-10-23T20:39:26.410340Z","package":{"ecosystem":"other","name":"zephyr"},"version":"4.5.0"}],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00112,"percentile":0.0131,"score_date":"2026-10-23"},"published_at":"2026-10-19T22:49:40.334Z","modified_at":"2026-10-20T19:21:46.367Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-19595","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T19:21:46.367Z"},{"source":"GitHub Advisory Database","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7337-mc44-5wjm","fetched_at":"2026-10-23T20:39:26.410340Z","source_modified_at":"2026-10-19T20:52:15Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19595","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/bea93400138362691403b7f81de1e9048681547d","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7337-mc44-5wjm"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T19:21:33.416588Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T19:21:46.367Z","content_hash":"a084d79c10cce08277661d12ea6fcaf501470e360b9850cc7158d04630759705"}}