Executive brief
A vulnerability was identified in the Linux kernel's Near Field Communication (NFC) component. This flaw could allow a local user to trigger an error by sending specially crafted data packets that the system does not properly validate. Successful exploitation could lead to unauthorized access to system memory information or cause a system crash, impacting the stability and confidentiality of the device.
Technical details
A use of uninitialized resource vulnerability (CWE-908) exists in the Linux kernel's NFC Controller Interface (NCI) core. The function nci_rx_work() fails to properly validate the header size, payload size, and total packet size of incoming data from the receive queue (ndev->rx_q) before processing. A local attacker can exploit this by providing malformed NCI packets, leading to uninitialized value access. This can result in a kernel information leak or a denial-of-service (system crash). The fix introduces a validation check (nci_valid_size) to ensure packets meet minimum size requirements before they are processed.
Affected products
- Linux Linux Kernel 4.19.312 to 4.19.316, 5.4.274 to 5.4.278, 5.10.215 to 5.10.219, 5.15.154 to 5.15.161, 6.1.85 to 6.1.93, 6.6.26 to 6.6.33, 6.8.5 to 6.9.4
Timeline
- 2024-05-19: other: Patch authored
- 2024-06-12: patched: Fix committed to stable tree
- 2024-06-21: disclosed: CVE published
References
- https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c
- https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6
- https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619
- https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe
- https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed
- https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea
- https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3