CVE-2026-19571

Executive Summary

CVE-2026-19571 is a race condition (CWE-362) in the ITE IT8xxx2 SHI (Serial Host Interface) host-command backend of the Zephyr RTOS, located in subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c. The host processor, acting as SPI controller, can inject an oversized data_len header into the shared receive buffer before the driver validates it, causing the embedded-controller framework to hand a registered command handler a 65535-byte input buffer over a 256-byte allocation. This results in an out-of-bounds read of up to ~64 KiB of embedded-controller memory, with confidentiality and availability impact. CVSS 3.1 base score is 6.7 (Medium), reflecting local access and high attack complexity.

Technical Analysis

The vulnerability resides in the ITE IT8xxx2 SHI host-command backend at subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c, which implements the transport layer for host-to-embedded-controller commands over the SPI-based SHI peripheral. Per the NVD description, the code copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only afterwards checked the protocol version and the derived packet length. Because validation occurred after the copy, an attacker-controlled header was already resident in in_msg at the moment length checking executed.

The interrupt handler compounded the problem by accepting a chip-select assertion and an Rx-valid-length (RVLI) interrupt in any driver state other than SHI_STATE_DISABLED. This meant a new header could be parsed while the host-command thread was still processing the previous request out of the very same in_msg buffer. The host processor controls both chip select and the SPI clock, giving it full ordering control over these events.

The concrete race proceeds as follows: the host sends a well-formed request, then immediately de-asserts chip select — which returns the driver to the ready state and re-enables the FIFO — and initiates a second transaction carrying a header with data_len = 0xFFFF. The eight bytes of that header are written into in_msg before the oversized length is rejected. Critically, these bytes land in a buffer whose contents verify_rx() in subsys/mgmt/ec_host_cmd/ec_host_cmd_handler.c has already validated. If the write lands in the window before the host-command thread executes args.input_buf_size = rx_header->data_len, the framework assigns the registered command handler a 65535-byte input length over a 256-byte buffer.

The result is an out-of-bounds read of up to approximately 64 KiB beyond the request buffer. Command handlers that copy or echo input_buf_size bytes will disclose adjacent embedded-controller memory. Note: the NVD description is truncated at "adjacent embedded-controller me" — the precise nature of the leaked data is not fully specified in the available data. The CVSS vector (C:H, A:H, I:N) indicates high confidentiality and high availability impact with no integrity impact, consistent with memory disclosure plus potential denial-of-service via out-of-bounds access.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the mechanism described in the NVD entry.

1. Reconnaissance / target identification: The attacker must have physical or logically privileged access to the SPI bus connecting the host processor to the ITE IT8xxx2 embedded controller running Zephyr. The host processor is the SPI controller, so the attacker operates from the host side — typically an untrusted or compromised host, a malicious peripheral, or an attacker with hardware access to the SPI bus. This is not a remote network attack (CVSS AV:L).

2. Triggering the flaw class: The attacker issues a well-formed host-command request to place the driver in the processing state, then de-asserts chip select to return the driver to ready state and re-enable the FIFO. A second SPI transaction is then started carrying a header with data_len = 0xFFFF. Because the header is copied into data->in_msg before the length is validated, the oversized length reaches verify_rx()-validated buffer contents.

3. Payload / execution at the vulnerability-class level: The attacker must win the race window — the timing between the second header landing in in_msg and the host-command thread's execution of args.input_buf_size = rx_header->data_len. When won, the framework hands a registered command handler a 65535-byte length over the 256-byte buffer. Any handler that copies or echoes input_buf_size bytes will read adjacent embedded-controller memory. The attacker then reads the returned data over the SPI interface to extract the leaked contents.

4. Post-exploitation impact: The out-of-bounds read discloses up to ~64 KiB of embedded-controller memory accessible in the transaction response. Depending on what resides adjacent to the request buffer (potentially keys, state, or other sensitive data — the NVD text is truncated here), this may reveal confidential material. The high availability score also implies potential crash or fault from the out-of-bounds access, causing denial of service on the embedded controller.

Impact Assessment

The vulnerability is confined to systems using the Zephyr RTOS ITE IT8xxx2 SHI host-command backend. Attackers require local (host-side) access to the SPI interface, consistent with CVSS 3.1 base score 6.7. Subscores: AV:L (local), AC:H (high complexity — requires winning a race window), PR:N (no privileges required), UI:N (no user interaction), S:U (unchanged scope), C:H (high confidentiality impact — memory disclosure), I:N (no integrity impact), A:H (high availability impact — potential crash/DoS of the EC).

Business impact centers on confidentiality of embedded-controller-resident data and availability of the EC subsystem. Because the exposed interface is an internal hardware bus, the primary risk is to platforms where the host processor may be untrusted relative to the EC — for example, a compromised host operating system communicating with a security-relevant EC. Blast radius is limited to affected ITE IT8xxx2-based designs running the impacted Zephyr backend; no KEV listing and no exploit-in-the-wild evidence is available.

Detection Guidance

Detection for this vulnerability is challenging because the trigger is a hardware-bus timing anomaly rather than a network protocol signature. The following rules should be treated as best-effort heuristics targeting anomalous host-command behavior and developer-side code inspection. No public detection signatures exist.

Sigma Rule

title: Zephyr ITE IT8xxx2 SHI Host-Command Race Condition Attempt
id: 3f9c1a72-6b41-4e0d-9c2a-7d5e8b1f0a44
status: experimental
description: Detects anomalous host-command backend events consistent with CVE-2026-19571 (oversized data_len racing the shared in_msg buffer).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19571
author: valtersit.com
logsource:
  product: zephyr
  service: ec_host_cmd
detection:
  selection_len:
    event.action: 'host_cmd_received'
    ec_host_cmd.header.data_len: '0xFFFF'
  selection_race:
    event.action: 'host_cmd_state'
    ec_host_cmd.state|contains: 'READY'
  condition: selection_len and selection_race
falsepositives:
  - Legitimate maximum-length commands (rare)
level: high

YARA Rule

rule CVE_2026_19571_Zephyr_SHII_ITE_Missing_Bounds
{
    meta:
        author = "valtersit.com"
        description = "Detects ITE IT8xxx2 SHI host-command backend source with header copy before length validation (CVE-2026-19571)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19571"
        date = "2026-01-01"
    strings:
        $f1 = "ec_host_cmd_backend_shi_ite.c" ascii
        $buf = "data->in_msg" ascii
        $hdr = "data_len" ascii
        $state = "SHI_STATE_DISABLED" ascii
        $rvli = "RVLI" ascii
    condition:
        $f1 or ($buf and $hdr and ($state or $rvli))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-19571 Possible Zephyr ITE IT8xxx2 SHI Oversized data_len Host-Command Race"; content:"|FF FF|"; offset:6; depth:2; flow:to_server; classtype:attempted-recon; sid:202619571; rev:1;)

Note: This rule is heuristic only; the SHI interface is a local SPI bus and is not typically traversed by Suricata. Deploy only if the SPI traffic is bridged or captured out-of-band.

Elastic Detection

process where event.category == "driver" and process.name == "zephyr_ec_host_cmd" and
  stringContains(event.action, "host_cmd") and
  stringContains(event.action, "data_len") and
  event.code == "OVERSIZED_LEN"

Splunk SPL Query

index=embedded sourcetype=zephyr:ec_host_cmd (action="host_cmd_received" OR action="host_cmd_state")
| eval dlen=coalesce(data_len, header_data_len)
| where dlen="0xFFFF" OR dlen=65535 OR match(action,"SHI_STATE")
| stats count values(dlen) values(state) by host, driver, action
| where count > 1

Wazuh OSSEC Rule

<group name="zephyr,ec_host_cmd,">
  <rule id="100971" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">host_cmd_received</field>
    <field name="data_len">0xFFFF</field>
    <description>CVE-2026-19571: Zephyr ITE IT8xxx2 SHI host-command oversized data_len header detected (possible race-condition memory disclosure attempt)</description>
    <mitre>
      <id>T1068</id>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100972" level="8">
    <decoded_as>json</decoded_as>
    <field name="action">host_cmd_state</field>
    <field name="state">SHI_STATE_READY</field>
    <description>CVE-2026-19571: SHI state transition to READY while host-command processing may be active</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict physical and logical access to the SPI bus between host and ITE IT8xxx2 EC; treat the host processor as an untrusted input source only if a hardware trust boundary is required.
   • Where feasible, gate the SHI host-command backend operation to be disabled except when trusted host firmware is executing.
   • Because the flaw is a missing post-copy re-validation and an overly permissive interrupt-state acceptance, a defensive code-level workaround is to ensure the header is re-validated against the shared in_msg contents after every FIFO copy and to reject RVLI/chip-select interrupts outside the appropriate processing state. No vendor-supplied workaround exists.
   • Monitor and constrain command handlers that copy or echo input_buf_size bytes, since these are the disclosure vector.

2. Patch / upgrade steps:

   • No vendor patch is available from any tracked source as of this report. Track the Zephyr project and ITE vendor advisories for a fixed release. The fix should reorder validation before the header copy into data->in_msg, and tighten interrupt acceptance to a single valid driver state.

3. Long-term hardening:

   • Adopt a validate-before-copy discipline for all host-supplied protocol headers.
   • Enforce single-owner semantics on in_msg so the interrupt path cannot overwrite a buffer under active processing.
   • Bound input_buf_size against the actual allocation size at the framework boundary in ec_host_cmd_handler.c.
   • Integrate static analysis and race-detection tooling (e.g., model checking) into embedded firmware CI.

References

• NVD — CVE-2026-19571: https://nvd.nist.gov/vuln/detail/CVE-2026-19571
• Zephyr Project — host command subsystem documentation: https://docs.zephyrproject.org/latest/services/device_mgmt/host_cmd.html
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization: https://cwe.mitre.org/data/definitions/362.html
• CISA KEV Catalog (no entry for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-19571 at the time of writing. No public PoC, Nuclei template, or exploit code is available.