A memory-safety vulnerability in the Zephyr RTOS logging subsystem allows for potential privilege escalation or system instability.

The system-call verifier z_vrfy_z_log_msg_static_create within the logging subsystem fails to enforce proper memory safety constraints. This vulnerability is exploitable by an authenticated user with low privileges.

Exploitation of this memory-safety flaw could allow a local attacker to bypass system-call protections, leading to information disclosure or a denial-of-service condition. Given the CVSS score of 8.4, the vulnerability is high-risk, particularly in environments where Zephyr is deployed in secure or mission-critical embedded systems.

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to address the vulnerable system-call verifier.

Proactive Monitoring: Monitor system logs for unexpected crashes or error conditions originating from the logging subsystem which may indicate attempted exploitation.

Compensating Controls: Ensure that user-space applications are strictly sandboxed and that system-call interfaces are restricted to the minimum necessary functions.

Public Exploit Available: Unknown

Given the potential for system-wide impact, organizations using Zephyr should prioritize updating to the patched version. Verify that the build environment incorporates the fix to ensure the integrity of the deployed firmware.