CVE-2026-18418
3.4LowPublished 11 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-125
Impact
A compromised peer core on the same SoC can leak adjacent stack or shared vring memory into system logs and potentially crash the receiving domain. An attacker needs control over the peer domain's firmware to send malformed IPC frames.
Root cause
The IPC backend logs a rejected frame's fixed-size channel name array using a '%s' format specifier without ensuring it is NUL-terminated, causing an out-of-bounds read during logging.
Affected systems
Zephyr RTOS with CONFIG_ZBUS_PROXY_AGENT_IPC enabled; specific release versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Fix & remediation
Apply commit fc065f79a568a6c6cc14b89795bd60e5eabd6f02 to Zephyr. As an interim workaround, disable CONFIG_ZBUS_PROXY_AGENT_IPC or lower the subsystem log level below warning to suppress the vulnerable print call.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all). Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC. The resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).