CVE-2026-7007

{
  "id": "CVE-2026-7007",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-24T15:19:08.047",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.\n\nDuring mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.\n\nAn attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.\n\nThe fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs."
    },
    {
      "lang": "es",
      "value": "El sistema de archivos ext2 de Zephyr valida el superbloque en disco en ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) antes de completar un montaje. El validador comprobó el número mágico, el tamaño del bloque, la revisión y los indicadores de características, pero no verificó que los campos en disco s_blocks_per_group y s_inodes_per_group no fueran cero. Ambos campos se leen directamente de la imagen y se utilizan posteriormente como divisores durante la inicialización en tiempo de montaje.\n\nDurante el montaje, get_ngroups() divide y calcula el módulo de s_blocks_count por s_blocks_per_group (alcanzado a través de ext2_fetch_block_group() desde ext2_init_fs()), y get_itable_entry() divide (ino - 1) por s_inodes_per_group al obtener el inodo raíz (ambos en subsys/fs/ext2/ext2_diskops.c). Un superbloque con cualquiera de los campos establecido en cero, por lo tanto, provoca una división entera por cero durante la secuencia de montaje.\n\nUn atacante que puede presentar una imagen ext2 manipulada a un dispositivo que monta ext2 - medios extraíbles como una tarjeta SD o un dispositivo de almacenamiento masivo USB - puede desencadenar esto. En objetivos ARMv7-M / ARMv8-M-mainline Cortex-M, la captura de división por cero está habilitada (SCB_CCR_DIV_0_TRP), por lo que la división genera un UsageFault que Zephyr trata como un error fatal, produciendo una denegación de servicio. El impacto se limita a la disponibilidad; el valor malformado se consume solo como divisor.\n\nLa solución rechaza un s_blocks_per_group o s_inodes_per_group cero en el validador del superbloque, devolviendo -EINVAL por lo que el montaje falla antes de que ocurra cualquier E/S de grupo de bloques o inodo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/fs/ext2/ext2_impl.c"
          ],
          "versions": [
            {
              "version": "3.5.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T15:03:26.497157Z",
          "id": "CVE-2026-7007",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-369"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-369"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.5.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "7F70CCFD-FCBB-436A-9E01-D8AAB9948497"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrf2-79mm-cvw5",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}