The ITE IT8xxx2 SHI host-command backend contains a data race that allows a second SPI request to override the length field of a request still being processed. Because the driver copies the 8‑byte header directly into the shared in‑msg buffer before checking the protocol version or the derived packet length, an attacker can supply a header with data_len set to 0xFFFF. When the host command thread later assigns this length to input_buf_size, the command handler receives a request length that far exceeds the 256‑byte request buffer, resulting in an out‑of‑bounds read of up to roughly 64 KiB. Handlers that copy or echo this length can leak memory adjacent to the control block, while overflow of the response buffer can cause a controller fault. The flaw therefore leads to memory disclosure and a potential crash.

Affected systems are Zephyr RTOS releases that include the unpatched SHI host‑command backend. No specific product version range is listed in the advisory, so any build containing the vulnerable ec_host_cmd_backend_shi_ite.c implementation is impacted. The vulnerability exists in the Zephyr project’s source tree prior to the commit that manages header parsing and interrupt handling.

The CVSS score of 6.7 indicates a medium‑severity flaw, and the EPSS score is not available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to control the inter‑processor SHI bus by compromising the host operating system or gaining physical access to the SPI lines and to orchestrate a timing race that repeats the transaction. Because the SPI controller can retry indefinitely, the race can be attempted repeatedly, but the attack still requires low‑level access to the hardware or a privileged host. Consequently the risk is moderate, but the potential impact of memory disclosure in a controller environment is significant.