Description

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were allocated before any check at all — including before the K_SYSCALL_DRIVER_FUEL_GAUGE() object-permission check. The subsequent k_usermode_from_copy() calls validated only that the user source buffer was readable; the kernel destination was never bounds-checked, since it was sized by the same attacker-chosen len. Any thread running in user mode with CONFIG_USERSPACE enabled can invoke fuel_gauge_get_props() or fuel_gauge_set_props() with a large len. This first displaces the supervisor stack pointer by an arbitrary attacker-chosen amount — Zephyr does not build with stack-clash probing, so the displacement itself does not fault, and the nested calls made by the verifier then write frames below the privileged stack. If the caller has been granted access to a fuel-gauge device object, the memcpy inside k_usermode_from_copy() additionally writes len * sizeof(union fuel_gauge_prop_val) bytes of fully attacker-controlled data starting well below the stack base. CONFIG_PRIVILEGED_STACK_SIZE defaults to 1024 bytes, so a len of roughly 170 already exhausts it. The result is an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content — a break out of the user-mode sandbox into kernel memory, leading to kernel code execution or a system crash. A stack guard region does not contain it, because the copy begins below the guard and walks upward, corrupting unprotected memory before the guard is reached. The fix removes the kernel-side copies entirely and validates the caller's arrays in place with K_SYSCALL_MEMORY_ARRAY_READ() / K_SYSCALL_MEMORY_ARRAY_WRITE(), which also handle the len * size multiplication overflow; this is safe because neither fuel_gauge_prop_t nor union fuel_gauge_prop_val contains embedded pointers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-11T18:16:58.563Z",
  "pubdate": "2026-10-11T18:16:58.563Z",
  "executiveSummary": "This vulnerability involves a critical stack-based buffer overflow in the Zephyr RTOS fuel gauge driver syscall handlers. The flaw originates from the use of attacker-controlled variable-length arrays (VLAs) within kernel space without prior size validation. By supplying an arbitrary length argument, an unprivileged user-mode thread can trigger an out-of-bounds write to the supervisor stack.\nThe vulnerability allows an attacker to bypass the user-mode sandbox, leading to arbitrary kernel memory corruption, potential privilege escalation, or system-wide denial-of-service via kernel crash. Exploitation requires the attacker to have access to a fuel-gauge device object. Given the lack of stack-clash protection in affected configurations, the stack pointer can be manipulated to overwrite sensitive kernel memory or execute malicious code, making this a high-risk security flaw for systems utilizing CONFIG_USERSPACE.\nMitigation requires refactoring the syscall handlers to validate buffer boundaries using established kernel macros before memory operations, effectively eliminating the reliance on stack-allocated arrays sized by user input.",
  "technicalDetails": "The vulnerability resides in the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() within drivers/fuel_gauge/fuel_gauge_syscall_handlers.c. The root cause is the immediate allocation of variable-length arrays (VLAs) using a user-provided len argument before any security validation—such as device object permission checks—occurs.\nThe kernel blindly trusts the len parameter provided via the syscall ABI to size the arrays k_vals and k_props. Because these are allocated on the supervisor stack, an attacker providing a sufficiently large len can displace the stack pointer. In the absence of stack-clash probing, the CPU does not trigger a fault when the stack pointer moves outside the defined stack boundaries.\nThe attack flow proceeds as follows: 1) An attacker with user-mode privileges initializes a syscall to fuel_gauge_get_props() or set_props() with a large, maliciously crafted len value. 2) The kernel allocates the VLAs on the supervisor stack, effectively shifting the stack pointer into unprotected kernel memory regions. 3) The function proceeds to execute k_usermode_from_copy() or similar logic. Because the kernel destination buffer was calculated using the malicious len, the subsequent memcpy operation performs an out-of-bounds write.\nThis behavior facilitates a bypass of the system's stack guard. By initiating the copy below the stack base and writing upwards, the operation corrupts critical kernel data structures or function pointers before reaching the guard region. If the attacker has obtained a handle to a fuel-gauge device, they gain the ability to write attacker-controlled payloads directly into kernel space memory, which can be leveraged to hijack kernel execution flow.\nThe lack of bounds checking on the kernel-side destination buffer, combined with the lack of integer overflow protection during the size calculation (len * sizeof(union fuel_gauge_prop_val)), enables an attacker to influence memory layout precisely. The vulnerability is persistent across any configuration where CONFIG_USERSPACE is enabled, as the verifier function is the entry point for privileged operations initiated from untrusted user code. The impact is a total compromise of the kernel's integrity, as the attacker effectively escapes the user-mode sandbox to perform unauthorized operations at the supervisor level."
}