Listen to this Post
Technical Deep Dive
The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) implements frame reassembly for OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer `ctx->buf` of size CONFIG_ETH_ADIN2111_BUFFER_SIZE, which defaults to 1524 bytes. The vulnerability resides in the `eth_adin2111_oa_data_read()` function, where each valid chunk is copied via `memcpy()` into `ctx->buf[ctx->scur]` and the write cursor `scur` is subsequently advanced.
The critical flaw lies in the absence of a bounds check verifying that `scur + len` remains within the allocated buffer boundaries. The number of chunks, derived from the BUFSTS RCA field and capped at 255, along with each chunk’s length, are taken entirely from frame data received off the wire. The cursor is only reset upon receiving a start-of-frame chunk, meaning an attacker on the same single-pair Ethernet segment can craft a malicious frame whose reassembled size exceeds the configured buffer.
As the driver’s RX offload thread processes these attacker-controlled chunks, it performs sequential memory copies without validating the cumulative write size. This allows the thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver or kernel memory. In the worst case, the out-of-bounds write can extend up to approximately 14.8 KB beyond the buffer. The defect was introduced when OA SPI support was added via commit `0ca8b0756b1` and affects all Zephyr releases from v3.7.0 through v4.4.0. The fix introduces a bounds check that drops oversized frames and resets the cursor before performing the copy operation.
DailyCVE Form:
Platform: Zephyr RTOS
Version: v3.7.0–v4.4.0
Vulnerability: OOB write (CWE-787)
Severity: High (CVSS 8.3)
date: 2026-07-15
Prediction: 2026-08-01
What Undercode Say:
Check Zephyr version
west --version
cat zephyr/VERSION | grep VERSION_MAJOR
Locate vulnerable driver
find . -name "eth_adin2111.c" -exec grep -l "eth_adin2111_oa_data_read" {} \;
Verify buffer size configuration
grep -r "CONFIG_ETH_ADIN2111_BUFFER_SIZE" zephyr/
Check if bounds check is present (fixed version)
grep -A 10 "eth_adin2111_oa_data_read" drivers/ethernet/eth_adin2111.c | grep "scur + len"
Analytics: The vulnerability affects all Zephyr deployments using the ADIN2111/ADIN1110 driver in OA SPI mode. Approximately 14.8 KB of adjacent memory can be corrupted per attack attempt. The CVSS vector `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H` indicates high integrity and availability impact with low confidentiality impact. EPSS probability is estimated at 0.23% (15th percentile). The vulnerability was under embargo until 2026-07-15.
Exploit: (Educational Purposes!)
/
Conceptual exploitation of CVE-2026-10673
This is for educational purposes only
/
// Craft malicious frame with excessive chunks
struct malicious_frame {
uint8_t start_of_frame; // SOF marker
uint8_t chunk_count; // Set to 255 (max from BUFSTS RCA)
uint8_t chunks[bash][64]; // Each chunk length controlled by attacker
// Total size: 1 + 1 + (255 64) = 16,322 bytes
// Exceeds default 1524-byte buffer by ~14.8 KB
};
// Send frame on single-pair Ethernet segment
void send_exploit_frame(void) {
struct malicious_frame frame;
memset(&frame, 0x41, sizeof(frame)); // Fill with controlled data
frame.start_of_frame = 0x01;
frame.chunk_count = 0xFF; // 255 chunks
// Transmit frame to trigger OOB write
ethernet_send(&frame, sizeof(frame));
}
Attack Vector: An attacker on the same single-pair Ethernet segment sends a crafted Ethernet frame containing up to 255 data chunks with attacker-controlled lengths. The driver’s RX offload thread processes these chunks sequentially, writing past the 1524-byte buffer into adjacent kernel memory.
Protection:
- Upgrade Zephyr: Apply the vendor patch that adds explicit bounds checking in
eth_adin2111_oa_data_read(). Upgrade to a release later than v4.4.0. - Disable OA SPI Mode: If patching is not immediately possible, disable or avoid using the ADIN2111/ADIN1110 driver in OPEN Alliance SPI mode.
- Network Segmentation: Limit exposure of affected devices to untrusted nodes on the single-pair Ethernet segment.
- Traffic Monitoring: Monitor for repeated malformed or oversized Ethernet traffic on affected links to detect potential exploitation attempts.
Impact:
- Denial of Service: Memory corruption causes system crashes, kernel panics, or driver instability.
- Code Execution: Attacker-controlled data written beyond buffer may overwrite critical kernel structures, function pointers, or control flow information.
- Integrity & Availability: CVSS scores integrity and availability as High.
- Confidentiality: Limited impact (rated Low).
- Attack Surface: Remotely reachable within the physical network segment; does not require prior system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
