Description

The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length (wlk_ate.len), which can exceed the supplied buffer length — only MIN(len, stored_len) bytes are actually copied, but the return value may be much larger, bounded only by the NVS sector size. Three sites (settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save()) used this value directly as the NUL index without clamping, so an oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset (CWE-787). The oversized entry cannot arise through the normal settings API, where names are bounded by SETTINGS_MAX_NAME_LEN. It requires an actor able to write the flash that backs the settings partition — a co-resident or untrusted component sharing the flash device, a malicious settings image/restore, or offline/physical flash access (a shared-flash threat model). The malformed entry is parsed when settings_load() runs at boot or subsystem init, or during settings_save(). The out-of-bounds write is a single NUL byte at an offset equal to the crafted entry length (up to the NVS sector size), so the practical impact is a crash or denial of service and limited stack corruption rather than reliable code execution. There is no confidentiality impact, and the path is not reachable from the network through the ordinary settings interface. The fix skips any entry whose nvs_read() length is greater than or equal to the buffer size before performing the NUL store.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T21:16:53.757Z",
  "pubdate": "2026-08-19T21:16:53.757Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability categorized under CWE-787 resides in the Non-Volatile Storage (NVS) backend of the Zephyr settings subsystem. Specifically located within subsys/settings/src/settings_nvs.c, the flaw affects the handling of stored setting-name entries read into fixed 74-byte stack buffers.\nThe vulnerability allows an actor capable of writing to the flash backing the settings partition to write a single NUL byte past the end of the stack buffer at an attacker-influenced offset. Exploitation requires physical flash access, a co-resident or untrusted component sharing the flash device, or a malicious settings image/restore.\nThe practical impact is limited to a system crash or denial of service due to restricted stack corruption, with no confidentiality impact or network exposure. The vulnerability is triggered automatically when settings_load() or settings_save() parses a malformed entry.",
  "technicalDetails": "The vulnerability stems from improper input validation and unsafe buffer index calculation when processing stored setting-name entries from Non-Volatile Storage. Within the Zephyr settings subsystem, specifically in subsys/settings/src/settings_nvs.c, the functions settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save() read setting-name entries into fixed 74-byte stack buffers utilizing the nvs_read() function.\nThe root cause is that nvs_read() returns the full stored entry length (wlk_ate.len) according to its API contract, which can exceed the allocated buffer length. Although nvs_read() copies only MIN(len, stored_len) bytes to prevent a traditional linear overflow of the copy destination, the return value rc can be much larger and is bounded only by the NVS sector size.\nThe vulnerable code uses this unvalidated return value directly as the index to NUL-terminate the buffer via the assignment buf[rc] = '\\0'. Because rc can vastly exceed the 74-byte capacity of the stack buffer, an oversized stored name entry causes a single NUL byte to be written out-of-bounds at an attacker-influenced offset onto the call stack.\nThe attack flow proceeds as follows: First, an attacker with access to modify the flash partition writes a malformed setting-name entry with an inflated length into the NVS storage. This cannot be achieved through the normal settings API due to standard length boundaries like SETTINGS_MAX_NAME_LEN, requiring shared-flash, offline, or physical access.\nSecond, when the device boots or the subsystem initializes, settings_load() or settings_save() is invoked, triggering the parsing of the NVS entries. Third, the vulnerable functions call nvs_read() to retrieve the setting name into the 74-byte stack buffer. Finally, the subsystem uses the oversized return value to place a NUL terminator far outside the stack buffer boundaries, resulting in stack corruption, memory overwrites, and a subsequent application crash or denial of service.\nThe payload behavior is restricted to a single out-of-bounds NUL byte write, precluding reliable arbitrary code execution. The vulnerability requires no authentication or network exposure, as it relies entirely on local flash persistence and execution mechanics during initialization or save routines."
}