The Zephyr ADIN2111/ADIN1110 Ethernet driver reassembles received Ethernet frames by copying 64-byte chunks into a fixed static buffer without verifying that the write cursor plus chunk length stays within the buffer size. The number of chunks and chunk length are derived from untrusted frame data. An attacker on the single-pair Ethernet segment can send a frame that causes the reassembled size to exceed the buffer, resulting in an out-of-bounds write of up to approximately 14.8 KB beyond the buffer into adjacent memory. This vulnerability (CWE-787) can cause memory corruption, denial of service, or potentially code execution. It affects Zephyr versions from 3.7.0 through before 4.5.0 and was introduced when OA SPI support was added. The fix involves adding a bounds check to drop oversized frames and reset the cursor before copying data.

An attacker with access to the single-pair Ethernet segment can exploit this vulnerability to perform an out-of-bounds write in kernel memory. This can lead to memory corruption, denial of service by crashing the driver or system, or potentially arbitrary code execution within the context of the driver. The CVSS v3.1 score is 8.3 (High), reflecting the network attack vector with no privileges required and no user interaction, and impacts on confidentiality (low), integrity (high), and availability (high).

A fix has been implemented that adds bounds checking to the Ethernet driver to drop oversized frames and reset the buffer cursor before copying data. Users should upgrade to Zephyr version 4.5.0 or later where this vulnerability is fixed. Until patched, avoid exposing the vulnerable Ethernet interface to untrusted networks or attackers on the single-pair Ethernet segment.