Zephyr kernel vulnerabilities

A time-of-check-to-time-of-use (TOCTOU) vulnerability in the Zephyr kernel's z_vrfy_i3c_transfer() handler for the i3c_transfer() system call. The caller-supplied I3C device descriptor is validated in place and then re-read from user memory at use time, allowing another thread in the same memory domain to swap the bus field between the check and the use. As a result, the kernel may call an attacker-controlled function pointer from an api table in supervisor mode.

A race condition in the Zephyr kernel affects z_waitq_head(), which on SMP systems reads the head of a thread wait queue without holding the _sched_spinlock. The race between timer expiration handling and thread abort can cause out-of-bounds and use-after-free writes in supervisor context plus scheduler state corruption.

A vulnerability in the Zephyr kernel affects the k_thread_join() and k_thread_abort() system calls. An error in access validation (thread_obj_validate()) allows an unprivileged user thread to invoke these functions on a thread object it does not own. Instead of terminating the offending thread, execution reaches undefined behavior, potentially causing a kernel crash (on Clang) or an access-control bypass (on GCC).

A vulnerability in the Zephyr kernel's z_queue_node_peek() in kernel/queue.c reads a node from the data_q list without holding the queue spinlock. A concurrent k_queue_get() can free the node during the operation, leading to use-after-free and a dangling pointer. This affects k_fifo and k_lifo queues used in net_buf, Bluetooth, USB, and networking subsystems.