CVE-2026-16513 Zephyr RTIO 任意地址写入漏洞
影响非特权用户线程可向任意内核地址写入指针，导致提权或内核崩溃
CVE-2026-16513 是 Zephyr RTOS 的 RTIO 子系统用户态验证器缺陷。z_vrfy_rtio_sqe_copy_in_get_handles() 在首次循环时未校验 handle 出参指针，直接以用户提供的地址执行 *handle = sqe 写入。攻击者可借此在管理员模式下向任意地址写入内核指针。
影响范围
Zephyr RTOS 中启用 CONFIG_USERSPACE 与 CONFIG_RTIO 的构建版本；subsys/rtio/rtio_handlers.c 在 v4.3.0 之前受影响，具体受影响版本范围暂无公开信息。
漏洞详情
该漏洞属于用户态验证器缺失内存写检查（CWE-787/CWE-822 类）。验证器只检查了 RTIO 对象句柄和 sqes 输入数组，却遗漏了 handle 出参，导致在第一次循环迭代时把新获取的提交队列条目内核地址写入攻击者指定的任意地址。写入发生在管理员模式且早于任何 SQE 内容校验，因此即使后续 SQE 被拒绝，写入仍会生效。
利用条件与风险
利用前提是目标系统启用了 CONFIG_USERSPACE 和 CONFIG_RTIO，且攻击者拥有一个已授权的 rtio 内核对象（普通非特权线程通过 sensor_read_async_mempool() 等异步 API 即可满足）。实战中可造成内核内存破坏，进而提权或拒绝服务，风险较高。
修复建议
官方修复方案为升级到包含修复的 Zephyr 版本（v4.3.0 及之后），该版本在写入前加入 K_SYSCALL_MEMORY_WRITE 检查。临时缓解措施包括禁用 CONFIG_USERSPACE 或 CONFIG_RTIO，或限制非特权线程对 RTIO API 的访问；具体补丁细节暂无公开信息。
The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the newly acquired submission-queue entry through a pointer taken verbatim from user mode, with no K_SYSCALL_MEMORY_WRITE check in front of it.
Any user-mode thread that has been granted a struct rtio kernel object can invoke the syscall with an arbitrary address in handle. That is the ordinary way an unprivileged thread uses the RTIO API, for example via sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally. The store happens in supervisor mode before any submission-entry validation, so it fires regardless of whether the SQE contents are subsequently rejected. Only builds with CONFIG_USERSPACE and CONFIG_RTIO are affected; without CONFIG_USERSPACE the verifier is not compiled and the caller is already privileged.
The write address is fully attacker-chosen and the written value is a pointer into the caller’s own RTIO ring, whose contents the caller controls (the following *sqe = sqes[i] copies an attacker-supplied struct rtio_sqe into that slot). This yields a write-what-where primitive placing a pointer to attacker-controlled data at any kernel address, sufficient to corrupt kernel function pointers, thread structures, or memory-domain partition tables, and thus to escalate from user mode to kernel mode, defeating the isolation boundary CONFIG_USERSPACE is meant to enforce. At minimum it is a reliable kernel memory-corruption and crash primitive. The reporter reproduced the write on qemu_x86: a K_USER thread changed a supervisor global from NULL to a live kernel SQE pointer.
The fix adds K_SYSCALL_MEMORY_WRITE(handle, sizeof(*handle)) (guarded by the existing optional-NULL semantics) before the loop, so the destination must lie in the calling thread’s writable memory domain or the thread is terminated by K_OOPS. The neighbouring verifier z_vrfy_rtio_cqe_get_mempool_buffer(), which checked its buff/buff_len out-parameters only for read although the implementation writes through them, was hardened separately by bea93400138 (“rtio: syscalls: validate output params as writable”); that residual was materially weaker, since a read check still confines the target to the caller’s own memory domain.