Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-369.
Summary
The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency. spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(). On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service. The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zephyrproject | zephyr | 1.8.0 to before 4.3.1; 4.4.0 to before 4.4.2 | 4.3.1, 4.4.2 | Patch available | CNA |
- zephyr Vendorzephyrproject Affected 1.8.0 to before 4.3.1; 4.4.0 to before 4.4.2 Fixed in 4.3.1, 4.4.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* | 1.8.0 – 4.4.1 | Vulnerable | zephyrproject |
- cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions 1.8.0 – 4.4.1 Vulnerable ·zephyrproject
Remediation
- Fix · CNA zephyr (zephyrproject) Fixed in 4.3.1, 4.4.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
zephyrproject zephyr 4.3.1, 4.4.2
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2026-09181 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflowPriority LOW 34
- TI-2026-09177 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)Priority LOW 29
- TI-2026-09178 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource poolPriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10679
- 2026-10-16 Fix available: [email protected], [email protected] · CNA
References
More zephyrproject Zephyr vulnerabilities
- TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
- TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
- TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
- TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
- TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
- TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences