Description

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded. tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller. The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call. Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-21T19:17:04.080Z",
  "pubdate": "2026-09-21T19:17:04.080Z",
  "executiveSummary": "A critical vulnerability exists in the Zephyr RTOS Time-aware GPIO (TGPIO) subsystem, specifically within the syscall verification handler z_vrfy_tgpio_pin_read_ts_ec().\nThe vulnerability is characterized as an arbitrary memory write (write-what-where primitive) occurring across the userspace-to-kernel boundary.\nThis flaw allows an unprivileged user-mode thread, provided it has access to the TGPIO device object, to overwrite arbitrary kernel memory locations with hardware-supplied timestamp and event counter data.\nThe root cause is the failure to validate caller-supplied output pointers using the K_SYSCALL_MEMORY_WRITE() macro, which is standard practice for syscall handlers in Zephyr when handling memory provided by userspace.\nExploitation leads to potential kernel memory corruption, enabling privilege escalation to supervisor mode or system instability (kernel panic).\nThe vulnerability exposure is limited to configurations where both CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y are enabled. Due to header file and macro changes in Zephyr v3.6.0 through v4.4.0, the code was effectively uncompilable, limiting the window of vulnerability to specific versions such as v3.5.0 or downstream implementations that manually corrected the build breakages.",
  "technicalDetails": "The vulnerability resides in the file drivers/timeaware_gpio/timeaware_gpio_handlers.c within the z_vrfy_tgpio_pin_read_ts_ec() syscall verification function. Syscall verification functions in Zephyr act as a security gatekeeper between the untrusted user-mode process and the privileged kernel-mode driver implementation. While other handlers in the same file correctly implemented K_SYSCALL_MEMORY_WRITE() to sanitize output pointers, z_vrfy_tgpio_pin_read_ts_ec() omitted these critical checks.\nThe attack flow begins when an unprivileged user-mode thread invokes the tgpio_pin_read_ts_ec() syscall. Because this function is marked with the __syscall attribute, the Zephyr syscall infrastructure routes the call through z_vrfy_tgpio_pin_read_ts_ec(). The attacker provides malicious, attacker-chosen addresses as the 'timestamp' and 'event_count' pointer arguments.\nThe handler incorrectly passes these raw pointers directly to the underlying driver function, tgpio_intel_read_ts_ec(), located in drivers/timeaware_gpio/timeaware_gpio_intel.c. The driver logic performs basic validation on the pin index but fails to verify the memory permissions of the provided pointers. Consequently, the driver executes two 8-byte stores in supervisor mode, writing hardware register contents (timestamp and event count) to the arbitrary addresses specified by the user-mode caller.\nThis behavior results in a classic write-what-where primitive. By controlling the destination address, an attacker can overwrite sensitive kernel data structures, such as thread control blocks, function pointers, or page tables. Successful manipulation of these structures allows the attacker to redirect kernel execution flow, effectively escalating privileges to supervisor mode.\nThe impact is significant: an attacker with restricted access to a TGPIO device can bypass memory protection boundaries. The exploit requires the attacker to have successfully been granted access to the TGPIO device object by the kernel, which is a specific, narrow capability. Post-exploitation impact ranges from arbitrary code execution within the kernel context to denial-of-service through system crashes caused by corrupted kernel memory structures.\nThe vulnerability is present in versions of Zephyr where the TGPIO driver is active, specifically v3.5.0. While later versions contained build-time regressions that masked the vulnerability, any system that resolved those regressions to enable TGPIO functionality on vulnerable codebases remains exposed."
}