CVE-2026-10678
Full vulnerability record from the local CVENow database.
Description
The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault. The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent. Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device. The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.
View original CVE JSON
{
"id": "CVE-2026-10678",
"sourceIdentifier": "[email protected]",
"published": "2026-07-21T22:17:00.047",
"lastModified": "2026-10-24T19:10:00.127",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault.\n\nThe same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent.\n\nBecause the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device.\n\nThe vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store."
},
{
"lang": "es",
"value": "El enlace de destino MCTP-over-I2C+GPIO en Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) procesa escrituras de pseudorregistros de un maestro de bus I2C byte a byte en mctp_i2c_gpio_target_write_received() sin validar el orden o el búfer de recepción. En las versiones afectadas, el gestor MCTP_I2C_GPIO_RX_MSG_ADDR (datos) desreferencia y escribe a través de b -> rx_pkt sin verificar que el búfer de recepción fue asignado: un controlador que selecciona el registro de datos y escribe un byte sin enviar primero el registro de longitud (que es lo que asigna el búfer) causa una escritura de un byte elegido por el atacante a través de un puntero mctp_pktbuf NULL/no asignado (es decir, en un pequeño desplazamiento por encima de la dirección 0, que el atacante puede avanzar), produciendo corrupción de memoria o un fallo grave.\n\nEl mismo gestor también realiza una prueba de límites de escribir-luego-verificar, permitiendo un desbordamiento de montículo de un byte en data[255] cuando se envían más de 255 bytes de datos.\n\nDebido a que la devolución de llamada del destino I2C se invoca con bytes sin procesar suministrados por cualquier dispositivo que sea el maestro del bus y el enlace no realiza autenticación, un controlador malicioso o que funciona mal en el bus puede activar esto sin ningún estado de protocolo previo, lo que lleva a corrupción de memoria y/o denegación de servicio en el dispositivo de destino.\n\nEl código vulnerable fue introducido cuando se añadió el enlace de destino I2C+GPIO y se distribuyó en Zephyr v4.3.0 y v4.4.0. La solución difiere la asignación al primer byte de datos con una verificación de NULL, trata una longitud faltante como un paquete de tamaño cero rechazado por libmctp, y mueve la verificación de límites antes del almacenamiento."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"include/zephyr/pmci/mctp/mctp_i2c_gpio_target.h",
"subsys/pmci/mctp/mctp_i2c_gpio_controller.c",
"subsys/pmci/mctp/mctp_i2c_gpio_target.c"
],
"versions": [
{
"version": "4.3.0",
"lessThan": "4.3.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-22T19:32:19.355281Z",
"id": "CVE-2026-10678",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-476"
},
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.0",
"versionEndIncluding": "4.4.1",
"matchCriteriaId": "AB673835-4CCD-49A7-9873-630B9EE2C814"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/9e23364261a2188c171d734d6947e02ee2a9510f",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pmwm-5rcm-39rr",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}