Vulnerability feed

Executive summary

A flaw in the Nuvoton NPCX eSPI driver, used for Target-Attached-Flash handling on NPCX and NPCK microcontrollers, allows an oversized flash request from the eSPI host to write past a fixed-size buffer in controller memory. The advisory says this can crash or hang the controller or corrupt driver state that controls flash protection regions, and it is only reachable by host firmware or bus-level control. The advisory describes a code fix that rejects oversized requests, but it does not state any affected or fixed version numbers.

Technical summary

The vulnerability is a buffer overflow caused by an unvalidated 12-bit length field in espi_taf_parse() in drivers/espi/espi_npcx.c, where a uint8_t counter can drive up to 255 copy iterations into a fixed 16-word (64-byte) structure member. The advisory says the overflow can write about 956 bytes past the end of the structure into .bss and can also cause out-of-bounds reads and a flash write of up to 4 KB of adjacent SRAM, and a related four-byte stack overflow exists in taf_npcx_completion_handler() on SoCs with tx-plsize of 64. The attack requires an eSPI host that sends a request violating the negotiated rx-plsize, and only configurations with CONFIG_ESPI_TAF enabled are affected. The advisory describes the fix as widening the counters, rejecting oversized word counts, adding an invalid_flag path, bounding the transmit payload, and adding a default case for unsupported cycle types. Affected version numbers, fixed version numbers, CVSS score, and in-the-wild exploitation status are not stated, and no detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Affects

zephyrprojectNuvotonzephyrproject zephyrNuvoton NPCX eSPI driver