Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6a2968aaf50c7a22fced77a5e24aa636281efca8 to < 11387b2effbb55f58dc2111ef4b4b896f2756240affected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < 03fe259649a551d336a7f20919b641ea100e3fffaffected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < 755e53bbc61bc1aff90eafa64c8c2464fd3dfa3caffected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < ac68d9fa09e410fa3ed20fb721d56aa558695e16affected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7affected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < a946ebee45b09294c8b0b0e77410b763c4d2817aaffected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < 8948e30de81faee87eeee01ef42a1f6008f5a83aaffected6a2968aaf50c7a22fced77a5e24aa636281efca8 to < d24b03535e5eb82e025219c2f632b485409c898faffected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected4.19.312 to ≤ 4.19.*unaffected5.4.274 to ≤ 5.4.*unaffected5.10.215 to ≤ 5.10.*unaffected5.15.154 to ≤ 5.15.*unaffected6.1.85 to ≤ 6.1.*unaffected6.6.26 to ≤ 6.6.*unaffected6.8.5 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240 ↗
- https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff ↗
- https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c ↗
- https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16 ↗
- https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7 ↗
- https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a ↗
- https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a ↗
- https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗