CVE-2026-10673

{
  "id": "CVE-2026-10673",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T18:16:44.180",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and the write cursor scur advanced, with no check that scur + len stayed within the buffer. The number of chunks (up to 255, from the BUFSTS RCA field) and the per-chunk length are taken entirely from the frame data received off the wire; the cursor is only reset on a start-of-frame chunk. An attacker on the single-pair Ethernet segment can therefore send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory (up to roughly 14.8 KB in the worst case). This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution. The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy."
    },
    {
      "lang": "es",
      "value": "El controlador Ethernet Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L (drivers/ethernet/eth_adin2111.c) reensambla las tramas Ethernet recibidas en modo SPI de OPEN Alliance (OA) copiando fragmentos de datos de 64 bytes suministrados por el dispositivo en un búfer estático fijo ctx  ->  buf de tamaño CONFIG_ETH_ADIN2111_BUFFER_SIZE (por defecto 1524 bytes). En eth_adin2111_oa_data_read(), cada fragmento válido se copiaba con memcpy en ctx  ->  buf[ctx  ->  scur] y el cursor de escritura scur avanzaba, sin comprobar que scur + len permaneciera dentro del búfer. El número de fragmentos (hasta 255, del campo BUFSTS RCA) y la longitud por fragmento se toman completamente de los datos de la trama recibidos del cable; el cursor solo se restablece en un fragmento de inicio de trama. Un atacante en el segmento Ethernet de par único puede, por lo tanto, enviar una trama cuyo tamaño reensamblado excede el búfer configurado, haciendo que el hilo de descarga RX del controlador escriba bytes de trama controlados por el atacante más allá del final del búfer estático en memoria adyacente del controlador/kernel (hasta aproximadamente 14.8 KB en el peor de los casos). Esto es una escritura fuera de límites (CWE-787) alcanzable de forma remota/adyacente que puede corromper la memoria y causar denegación de servicio o potencialmente ejecución de código. El defecto se introdujo cuando se añadió el soporte para OA SPI (commit 0ca8b0756b1) y se distribuyó en las versiones v3.7.0 hasta la v4.4.0. La solución añade una comprobación de límites que descarta la trama sobredimensionada y restablece el cursor antes de la copia."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/ethernet/eth_adin2111.c",
            "drivers/ethernet/eth_adin2111_priv.h"
          ],
          "versions": [
            {
              "version": "3.7.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T18:00:59.180581Z",
          "id": "CVE-2026-10673",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.7.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "9F648F66-9415-47A6-92AD-4C61A70269B2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/158df8d088316cdae20816fc07703892280b2acb",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/c98321cbfef23c0e3bdf043ccf6b421067c8d508",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hm6v-4jh4-3qc4",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hm6v-4jh4-3qc4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}