Executive brief
A vulnerability exists in the Linux kernel's Near Field Communication (NFC) component, which handles short-range wireless communication. An attacker could exploit this flaw to cause memory corruption, potentially leading to a system crash or unauthorized access to sensitive information. This affects devices using NFC technology that run vulnerable versions of the Linux operating system.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the nci_hci_create_pipe() function within the Linux kernel's NFC subsystem. The 'pipe' variable, a u8 value received from the network, is used without adequate bounds checking. If the value exceeds 127, it leads to memory corruption in the calling function, nci_hci_connect_gate(). An attacker with the ability to influence NCI network traffic can trigger this corruption to achieve local privilege escalation or cause a denial of service. Patches have been released across multiple stable kernel branches (e.g., 6.1.129, 6.6.78, 6.12.14, 6.13.3).
Affected products
- Linux Linux Kernel 4.4 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2025-01-17: other: Vulnerability fixed in source code
- 2025-02-26: disclosed: CVE published by kernel.org
- 2025-02-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/10b3f947b609713e04022101f492d288a014ddfa
- https://git.kernel.org/stable/c/110b43ef05342d5a11284cc8b21582b698b4ef1c
- https://git.kernel.org/stable/c/172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e
- https://git.kernel.org/stable/c/2ae4bade5a64d126bd18eb66bd419005c5550218
- https://git.kernel.org/stable/c/59c7ed20217c0939862fbf8145bc49d5b3a13f4f
- https://git.kernel.org/stable/c/674e17c5933779a8bf5c15d596fdfcb5ccdebbc2
- https://git.kernel.org/stable/c/bd249109d266f1d52548c46634a15b71656e0d44