dynamic_object_create() in kernel\/userspace\/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed overhead), without checking either expression for unsigned wrap-around. A size close to SIZE_MAX makes the computed total wrap to a very small value, so the heap chunk handed out is a few bytes while the object descriptor is still tagged with the full requested type and registered in the kernel object table.<\/p>\n
The size argument reaches that arithmetic directly from user mode. k_object_alloc_size() is declared __syscall in include\/zephyr\/sys\/kobject.h, its verifier z_vrfy_k_object_alloc_size() in kernel\/userspace\/userspace_handler.c is a bare pass-through, and z_object_alloc() only range-checks otype \u2014 nothing bounds size. The stack-element branch is additionally reachable through the k_thread_stack_alloc() syscall via kernel\/dynamic.c. Because subsequent kernel-object validation checks only the object’s type and initialization state, the undersized handle passes K_SYSCALL_OBJ_INIT()\/K_SYSCALL_OBJ_NEVER_INIT(), and the matching init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a complete object over the truncated allocation.<\/p>\n
An unprivileged user-mode thread can therefore trigger a supervisor-mode out-of-bounds write into the kernel resource-pool heap, of a size and content it substantially controls, corrupting sys_heap chunk metadata and adjacent kernel objects. Under CONFIG_GEN_PRIV_STACKS the thread-stack branch additionally stores an attacker-influenced wild pointer as a user thread’s privileged stack base. The practical result is escape from the CONFIG_USERSPACE sandbox \u2014 kernel-level code execution or at minimum kernel memory corruption and system compromise.<\/p>\n
Exploitation requires CONFIG_USERSPACE together with CONFIG_DYNAMIC_OBJECTS (also selected by CONFIG_DYNAMIC_THREAD under userspace), and a calling thread with an assigned resource pool. The fix rejects both overflowing computations and frees the partially built descriptor.<\/p>\n","protected":false},"excerpt":{"rendered":"
dynamic_object_create() in kernel\/userspace\/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34931","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}