A memory safety flaw in the Zephyr RTOS kernel allows an authenticated local attacker to achieve a write-what-where primitive, posing a critical risk of privilege escalation or system instability.

The vulnerability exists in the z_vrfy_tgpio_pin_read_ts_ec syscall handler, which fails to validate memory pointers provided by user-mode threads. An authenticated user with access to the TGPIO device object can trigger an arbitrary write in supervisor mode, effectively bypassing kernel memory protections.

Successful exploitation of this vulnerability allows an attacker to corrupt kernel data structures, which can be leveraged to escalate privileges from a restricted user to full supervisor control. Given the CVSS score of 7.8, this represents a high-severity risk for embedded systems where kernel integrity is the primary defense mechanism against unauthorized access and system compromise.

Immediate Action: Update the Zephyr RTOS environment to version 4.4.2 or later, which includes the necessary K_SYSCALL_MEMORY_WRITE validation checks to prevent unauthorized memory access.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or initialize the Time-aware GPIO device object, particularly in environments where CONFIG_USERSPACE and CONFIG_TIMEAWARE_GPIO are enabled.

Compensating Controls: Restrict access to TGPIO device objects to only those processes that strictly require them, thereby reducing the attack surface for unprivileged users attempting to invoke the vulnerable syscall.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the Zephyr RTOS must prioritize patching to version 4.4.2 to eliminate this kernel-level memory vulnerability. Because this flaw allows for full system compromise via privilege escalation, immediate remediation is strongly advised for all affected deployments.