The vulnerability in Zephyr's recvmsg() implementation involves insufficient validation of the ancillary control buffer length, where the check only considers the payload length but omits the control message header size. This allows an attacker to provide a control buffer length that passes the check but is actually too small, causing an out-of-bounds write of up to approximately 12 bytes beyond the buffer. Under CONFIG_USERSPACE, this leads to kernel heap corruption since the verifier allocates a kernel-heap copy of the control buffer. The flaw is exploitable by an unprivileged userspace thread on UDP/IP sockets with IP_PKTINFO or IPV6_RECVPKTINFO enabled when receiving datagrams with undersized control buffers. The fix involves using NET_CMSG_SPACE(pktinfo_len) for capacity checking and returning -ENOMEM if the buffer is too small. Affected versions are from 3.6.0 through 4.4.0.

Successful exploitation can cause kernel heap memory corruption or caller buffer corruption, potentially leading to denial of service or privilege escalation. The vulnerability affects confidentiality, integrity, and availability of the system. It is exploitable by unprivileged userspace processes under certain socket configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves correcting the buffer size check to include the control message header size and returning an error when the buffer is too small. Until a patch is available, avoid using recvmsg() with undersized control buffers on UDP/IP sockets with IP_PKTINFO or related options enabled.