CVE-2026-10643

{
  "id": "CVE-2026-10643",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-28T00:16:24.637",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length falls in the under-checked window (e.g. 16-27 bytes for IPv4 IP_PKTINFO on a 64-bit target, where a single element actually occupies 28 bytes) passes the guard yet causes a fixed-size out-of-bounds write of up to one cmsg header (~12 bytes) past the end of the buffer.\n\nUnder CONFIG_USERSPACE the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and runs the implementation against it, so the overflow corrupts kernel heap memory and is triggerable from an unprivileged userspace thread; in supervisor mode it corrupts the caller's buffer.\n\nThe path is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled when the application calls recvmsg() with an undersized control buffer and a datagram is received; part of the overwritten bytes (the destination IP in ipi_addr) is influenced by the received packet.\n\nThe fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) (aligned header + aligned data) and returns -ENOMEM when the buffer is too small. Affected: v3.6.0 through v4.4.0."
    },
    {
      "lang": "es",
      "value": "La implementación de recvmsg() del socket IP de Zephyr (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validaba el búfer auxiliar (msg_control) proporcionado por el usuario utilizando solo la longitud de la carga útil (msg-msg_controllen < pktinfo_len) antes de escribir un mensaje de control completo que consistía en una cabecera cmsg alineada más la carga útil. Debido a que la comprobación omitía el tamaño de la cabecera cmsg, un búfer de control cuya longitud cae en la ventana insuficientemente comprobada (por ejemplo, 16-27 bytes para IPv4 IP_PKTINFO en un objetivo de 64 bits, donde un solo elemento ocupa realmente 28 bytes) pasa la protección pero causa una escritura fuera de límites de tamaño fijo de hasta una cabecera cmsg (~12 bytes) más allá del final del búfer. Bajo CONFIG_USERSPACE, el verificador de recvmsg asigna una copia en el heap del kernel del búfer de control con un tamaño igual a msg_controllen y ejecuta la implementación sobre ella, por lo que el desbordamiento corrompe la memoria del heap del kernel y es activable desde un hilo de espacio de usuario no privilegiado; en modo supervisor corrompe el búfer del llamador. La ruta es alcanzable en un socket UDP/IP con IP_PKTINFO/IPV6_RECVPKTINFO (o hoplimit/timestamping) habilitado cuando la aplicación llama a recvmsg() con un búfer de control de tamaño insuficiente y se recibe un datagrama; parte de los bytes sobrescritos (la IP de destino en ipi_addr) está influenciada por el paquete recibido. La solución hace que la comprobación de capacidad utilice NET_CMSG_SPACE(pktinfo_len) (cabecera alineada + datos alineados) y devuelve -ENOMEM cuando el búfer es demasiado pequeño. Afectado: v3.6.0 hasta v4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/net/lib/sockets/sockets_inet.c"
          ],
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:52:52.031981Z",
          "id": "CVE-2026-10643",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.6.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "A9A10DBF-7D69-469E-9685-0391AFDFE33B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/01fe77b2ec3885583f709a17c5203ce02bd77012",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pvf7-7mrp-35w7",
      "source": "[email protected]"
    }
  ]
}