Vulnerability feed

Executive summary

A bug in the Broadcom AFBR-S50 time-of-flight sensor driver can corrupt memory in devices that use this sensor, causing crashes or loss of availability. The advisory says an attacker in front of the sensor could trigger the fault with light conditions, though the attacker does not control the corrupted content. The advisory does not state a severity score or a fixed version, and it does not give vendor recommendations beyond the description of the fault.

Technical summary

The driver's data_ready_work_handler() in drivers/sensor/broadcom/afbr_s50/afbr_s50.c completes the same RTIO submission twice when Argus_EvaluateData() returns a non-OK status, because the error branch does not return. This double completion frees and reuses a submission pool entry, corrupts the mpsc submission queue, and can write through a released buffer, which the advisory describes as memory corruption and loss of availability rather than code execution. The fault is triggered by sensor conditions such as harsh ambient light or sharp distance transitions, and SPI transfer errors reach the same branch, so no physical or software access is required per the advisory. Affected and fixed versions are not stated, and no workaround is stated. The advisory does not give detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Physical

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

zephyrprojectBroadcomzephyrproject zephyrBroadcom AFBR-S50