The flash_copy() syscall in Zephyr prior to version 4.4.2 with CONFIG_USERSPACE enabled did not validate the src_dev and dst_dev device pointers passed from user mode. This allowed a user-mode thread to supply forged struct device pointers whose API function tables contained attacker-controlled function pointers. The kernel dereferenced these pointers and called through them without validation, enabling arbitrary code execution in supervisor mode (local privilege escalation). The vulnerability also allows kernel denial-of-service or information disclosure if invalid addresses are used. The fix adds K_SYSCALL_DRIVER_FLASH() validation macros to verify that device pointers are registered flash-driver kernel objects accessible by the caller before dereference, fully mitigating the issue.

An unprivileged user-mode thread can escalate privileges to kernel mode by exploiting this vulnerability, potentially executing arbitrary code with kernel privileges. Lesser impacts include kernel crashes (denial-of-service) and information disclosure due to out-of-bounds reads. The vulnerability compromises the userspace sandbox isolation, posing a significant security risk in affected Zephyr versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding K_SYSCALL_DRIVER_FLASH() validation macros to the syscall handler to verify device pointers before use. Users should monitor the Zephyr project advisories for official patches or updates addressing this issue. Until patched, restricting unprivileged users' ability to invoke flash_copy() or disabling CONFIG_USERSPACE may reduce risk.