CVE-2024-11263

When the CONFIG_RISCV_GP=y option is enabled, the GP register points to an address 0x800 bytes past the beginning of the .sdata section. The linker uses this value to optimize accesses to global symbols through a relaxation mechanism. Improper use or manipulation of this mechanism can lead to unauthorized memory access beyond the expected range, which is classified as a permission error (CWE-270).

An attacker can gain unauthorized access to system resources, compromising confidentiality, integrity, and availability — including potentially executing code or modifying data outside the boundaries of an authorized area. The scope of the attack extends beyond the vulnerable component (Scope: Changed).

Patches available from the vendor should be applied according to the references — details are available in the official Zephyr project security advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jjf3-7x72-pqm9.

The Zephyr RTOS operating system by Zephyrproject configured with the CONFIG_RISCV_GP=y option on RISC-V platforms; specific versions are indicated in vendor references.