Description

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window. On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint). The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-24T15:16:49.010Z",
  "pubdate": "2026-08-24T15:16:49.010Z",
  "executiveSummary": "A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in the userspace system call verification logic for the mailbox subsystem.\nThe vulnerability type is a race condition leading to improper validation of array index or pointer values, specifically manifesting as a TOCTOU flaw.\nThe impact includes an access-control bypass allowing unprivileged userspace threads to achieve high confidentiality compromise via arbitrary kernel memory disclosure, or to trigger a kernel fault resulting in a denial of service.\nAffected systems are those built with CONFIG_USERSPACE enabled, utilizing the affected mailbox handlers.\nThe risk implications are severe, as local unprivileged users can escalate their access patterns to read restricted kernel memory or destabilize the operating system.\nAttacker capabilities require the ability to execute unprivileged code within userspace and spawn concurrent threads sharing the same address space to exploit the race window.\nExploitation requirements include a system configured with CONFIG_USERSPACE and multi-threading capabilities allowing race conditions against the mailbox system call.",
  "technicalDetails": "The root cause of the vulnerability resides in the userspace syscall verifier function z_vrfy_mbox_send() located within drivers/mbox/mbox_handlers.c.\nThe verifier validates nested msg->data and msg->size fields by reading them directly from live userspace memory.\nFollowing validation, the verifier forwards the original, still-mutable userspace struct mbox_msg pointer to z_impl_mbox_send() and the underlying driver instead of using a securely copied and immutable structure.\nA time-of-check/time-of-use window is opened between the initial access check and the driver's eventual dereference of msg->data.\nOn a system built with CONFIG_USERSPACE, an unprivileged userspace thread invokes the mbox_send() system call.\nSimultaneously, a second thread sharing the caller's address space races to overwrite msg->data with a supervisor or kernel address after the verifier bounds check successfully passes but before the driver performs the read operation.\nThe underlying driver, such as the NXP mailbox driver, subsequently dereferences the attacker-chosen address in supervisor context using operations like memcpy(&data32, msg->data, msg->size).\nThe memory contents read from the supervisor-controlled address are then emitted directly to the peer mailbox endpoint.\nAuthentication and privilege requirements are minimal, requiring only an unprivileged userspace thread context with local code execution capabilities.\nNetwork exposure is not strictly required as the attack vector is local, targeting the kernel interface via system calls.\nPost-exploitation impact encompasses the disclosure of sensitive kernel memory contents or a kernel panic and denial of service induced by reading unmapped or invalid target addresses."
}