A critical out-of-bounds write vulnerability in the Zephyr RTOS Intel SEDI IPM driver could allow a local attacker to corrupt kernel memory and cause system instability.

The driver fails to check the payload length of inbound messages against the destination buffer size, allowing for an out-of-bounds write in interrupt context. This requires high privileges to manipulate memory-mapped registers, typically accessible by host-side software.

Successful exploitation results in kernel data structure corruption and immediate system crashes, leading to potential denial of service for critical embedded systems. While the CVSS score of 6.0 is categorized as medium, the impact on availability in real-time environments makes this a significant operational risk for devices utilizing the Intel SEDI IPM driver.

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to incorporate the necessary length validation logic.

Proactive Monitoring: Monitor system logs for unexpected reboots or kernel panics, particularly in environments where inter-processor communication is frequent.

Compensating Controls: Ensure that access to memory-mapped register windows is strictly restricted to authorized kernel-level processes to prevent unauthorized interaction with the IPM driver.

Public Exploit Available: Unknown

Given the potential for kernel-level memory corruption, organizations using Zephyr on Intel-based hardware must prioritize this update. Applying the patch in version 4.4.2 is the only definitive way to prevent this buffer overflow, as current production builds lack the necessary bounds checking to handle malformed IPC messages safely.