Junglewise Threat Intelligence

CVE-2024-35915: Linux Kernel uninitialized value access in NFC NCI core

CVE-2024-35915 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Near Field Communication (NFC) component. The system incorrectly handles certain malformed data packets received via NFC, which can lead to the software reading uninitialized memory. This could allow a local attacker to cause a system crash or unpredictable behavior, impacting the availability of the device.

Technical details

An uninitialized value access vulnerability exists in the Linux kernel's NFC Controller Interface (NCI) implementation within net/nfc/nci/core.c. The function nci_rx_work() fails to validate the payload length of incoming packets before passing them to message type handlers. When a packet with a zero-size payload is received, handlers attempt to read from uninitialized memory locations. This issue was detected by KMSAN and reported by syzbot. An attacker with local access could exploit this to cause a kernel panic or denial of service. The fix introduces a check to ensure the payload length is non-zero before further processing, silently discarding unexpected zero-length packets.

Affected products

  • Linux Linux Kernel 3.2 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.85, 6.2 to 6.6.26, 6.7 to 6.8.5, 6.9-rc1

Timeline

  • 2024-03-20: other: Patch authored
  • 2024-04-13: patched: Patch committed to stable branches
  • 2024-05-19: disclosed: CVE published

References