Summary

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution

Details

• ataes132a_send_command reads a device response and copies count - 3 bytes into a caller buffer without bounding the copy (drivers/crypto/crypto_ataes132a.c:140-166).
• During CCM decrypt, the destination is param_buffer[52] on the stack (drivers/crypto/crypto_ataes132a.c:208-357). A forged response with count up to 64 (max read) overflows param_buffer, overwriting adjacent stack data before returning to the caller.
• Attackers controlling the ATAES132A device or the I²C bus can trigger the overflow by returning a valid-CRC packet with an inflated count, leading to kernel-level memory corruption.

PoC

ataes132a-response-overflow-poc.tar.gz

1. Build and run the provided ASAN harness that includes the unmodified driver and stubs a malicious device response:

cd ataes132a-response-overflow-poc
make clean && make run

2. The run prints ASAN output reporting a stack-buffer-overflow in ataes132a_send_command when copying the forged 64-byte response into the 52-byte buffer.

Impact

Type: stack-based buffer overflow (CWE-120).
Who is impacted: any Zephyr build using the ATAES132A crypto driver; a malicious or faulty ATAES132A device, or an attacker with I²C bus access, can corrupt kernel stack memory, causing DoS or potential code execution in kernel context.

Acknowledgments

• Found by SecMate (https://secmate.dev)

Patches

main: #103163

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities
  embargo: 2026-03-09