VYPR
← All advisories
Unrated severityNVD Advisory· Published May 11, 2020· Updated Sep 17, 2024

ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers

CVE-2020-10024

Description

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.

Affected products

1

Patches

3
6da1361c71a1

arch: arm: userspace: fix syscall ID validation

https://github.com/zephyrproject-rtos/zephyrIoannis GlaropoulosMar 17, 2020via osv
commitPR #23535
1 file changed · +4 −1
  • arch/arm/core/swap_helper.S+4 −1 modified
    @@ -411,7 +411,10 @@ _do_syscall:
     /* validate syscall limit */
     ldr ip, =K_SYSCALL_LIMIT
     cmp r6, ip
-    blt valid_syscall_id
+    /* The supplied syscall_id must be lower than the limit
+     * (Requires unsigned integer comparison)
+     */
+    blo valid_syscall_id
 
     /* bad syscall id.  Set arg1 to bad id and set call_id to SYSCALL_BAD */
     str r6, [r0, #0]
61fc061fc43b

tests: kernel: userspace: extend bad syscall-ID test-case

https://github.com/zephyrproject-rtos/zephyrIoannis GlaropoulosMar 6, 2020via osv
commitPR #23323
1 file changed · +4 −0
  • tests/kernel/mem_protect/userspace/src/main.c+4 −0 modified
    @@ -1112,6 +1112,10 @@ void test_bad_syscall(void)
 
 	arch_syscall_invoke0(INT_MAX);
 
+	expect_fault = true;
+	expected_reason = K_ERR_KERNEL_OOPS;
+
+	arch_syscall_invoke0(UINT_MAX);
 }
 
 static struct k_sem recycle_sem;
d4f1e731307f

tests: kernel: userspace: extend bad syscall-ID test-case

https://github.com/zephyrproject-rtos/zephyrIoannis GlaropoulosMar 6, 2020via osv
commitPR #23498
1 file changed · +4 −0
  • tests/kernel/mem_protect/userspace/src/main.c+4 −0 modified
    @@ -1083,6 +1083,10 @@ void test_bad_syscall(void)
 
 	arch_syscall_invoke0(INT_MAX);
 
+	expect_fault = true;
+	expected_reason = K_ERR_KERNEL_OOPS;
+
+	arch_syscall_invoke0(UINT_MAX);
 }
 
 static struct k_sem recycle_sem;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.