Summary

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi->buf, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.

Details

• In eswifi_socket_send, the driver builds a header with snprintk(eswifi->buf, sizeof(eswifi->buf), "S3=%u\r", len); then sets offset = strlen(eswifi->buf); and does memcpy(&eswifi->buf[offset], buf, len); with no bounds check (drivers/wifi/eswifi/eswifi_socket_offload.c:288-295).
• eswifi->buf is bounded by CONFIG_WIFI_ESWIFI_MAX_DATA_SIZE (drivers/wifi/eswifi/eswifi.h:72). Any payload larger than the remaining space (sizeof(buf) - header) will write past the end before calling eswifi_request.
• Attack surface is any Zephyr application code that can invoke the socket offload send path; the vulnerability does not provide remote network entry—it is triggered locally by supplying an oversized buffer to the driver.

PoC

eswifi-socket-send-buffer-overflow-poc.tar.gz

1. Build and run the ASAN harness that pulls in the unmodified driver and issues an oversized send:

cd eswifi-socket-send-buffer-overflow-poc
make clean && make run

2. ASAN reports a buffer overflow in eswifi_socket_send when copying the large payload into eswifi->buf, demonstrating the real vulnerable code path.

Impact

Type: buffer overflow in driver staging buffer (CWE-120).
Who is impacted: Zephyr builds using the eswifi socket offload driver; any local code able to call the send API can corrupt kernel memory, leading to DoS or potential code execution.

Acknowledgments

• Found by SecMate (https://secmate.dev)

Patches

main: #102119

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2026-03-09