A buffer overflow vulnerability in the Zephyr RTOS eswifi driver permits local attackers with low privileges to achieve memory corruption and potential system instability.

The vulnerability is a classic buffer overflow (CWE-120) occurring because the eswifi socket offload driver fails to validate the size of user-provided payloads before copying them into a fixed buffer. The attack requires local access to code that can invoke the socket send API, meaning it cannot be triggered directly by a remote, unauthenticated attacker.

Successful exploitation of this flaw can result in unauthorized memory modification, which may lead to system crashes or privilege escalation within the RTOS environment. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of embedded systems, particularly those managing safety-critical or sensitive industrial processes.

Immediate Action: Review the Zephyr Project security advisory GHSA-qx3g-5g22-fq5w for specific patch availability and apply updates to the Zephyr RTOS codebase as soon as they are provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected reboots or kernel panic events that may indicate failed exploitation attempts of memory-related drivers.

Compensating Controls: Restrict access to the device socket interface to authorized processes only, and implement strict input validation at the application layer before passing data to the driver API.

Public Exploit Available: exploit_available (unknown)

While the vulnerability requires local access to reach the vulnerable endpoint, the potential for kernel-level memory corruption makes this a serious security concern for any environment utilizing Zephyr RTOS. IT and security teams should prioritize tracking the official Zephyr project security advisories to ensure that patches are integrated into their build pipelines immediately upon release.