{"id":"CVE-2026-17052","state":"PUBLISHED","title":"Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace","description":"The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded.\n\ntgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller.\n\nThe result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call.\n\nExposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.","publishedAt":"2026-09-21T18:35:30.081Z","updatedAt":"2026-09-21T18:43:05.834Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"zephyr"},"assigner":"zephyr","products":["zephyrproject zephyr"],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.5.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/timeaware_gpio/timeaware_gpio_handlers.c"],"programRoutines":[{"name":"tgpio_intel_read_ts_ec"},{"name":"tgpio_pin_read_ts_ec"},{"name":"z_vrfy_tgpio_pin_read_ts_ec"}]}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/26264fffc17c2174319394ffa274af3f6efdc221","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8qw6-x76h-8mpc"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/17xxx/CVE-2026-17052.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-17052","state":"PUBLISHED","datePublished":"2026-09-21T18:35:30.081Z","dateUpdated":"2026-09-21T18:43:05.834Z","assignerShortName":"zephyr","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateReserved":"2026-07-24T13:31:05.682Z"},"containers":{"cna":{"title":"Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace","descriptions":[{"lang":"en","value":"The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded.\n\ntgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller.\n\nThe result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call.\n\nExposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","packageName":"zephyr","defaultStatus":"unaffected","versions":[{"version":"3.5.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","programFiles":["drivers/timeaware_gpio/timeaware_gpio_handlers.c"],"programRoutines":[{"name":"tgpio_intel_read_ts_ec"},{"name":"tgpio_pin_read_ts_ec"},{"name":"z_vrfy_tgpio_pin_read_ts_ec"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/26264fffc17c2174319394ffa274af3f6efdc221","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8qw6-x76h-8mpc","name":"GHSA-8qw6-x76h-8mpc"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"memory-safety","type":"CWE"}]}],"providerMetadata":{"shortName":"zephyr","orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","dateUpdated":"2026-09-21T18:35:30.081Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-21T18:42:55.294194Z","id":"CVE-2026-17052","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-21T18:43:05.834Z"}}]}}}