Description
In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate. The fixed field offsets and UID copies were checked only against the destination nfc_target buffers, not against the actual skb length. Validate that each gate-specific payload contains the fixed fields and UID bytes before reading or copying them.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cfad1ba87150e198be9ea32367a24e500e59de2c to < c6de4241f2efbbab286efbb84a9c7190298b3052affectedcfad1ba87150e198be9ea32367a24e500e59de2c to < 92a6f0201bb68391b5eba1b3f330af007d7323b6affectedcfad1ba87150e198be9ea32367a24e500e59de2c to < cb298672282421159e53ab311fe49d204c8a52daaffectedcfad1ba87150e198be9ea32367a24e500e59de2c to < 18f02354ed229b8e4561b580812d026e7eb29c85affectedcfad1ba87150e198be9ea32367a24e500e59de2c to < e6397fe7b8b5ef18e051f49612d40ff476c5f7d9affectedcfad1ba87150e198be9ea32367a24e500e59de2c to < d0902a7c454326c6384c614226ab8987f3fd425daffectedcfad1ba87150e198be9ea32367a24e500e59de2c to < dabfa26a208e56f4d8dbf26fddc48f188bdb0649affectedcfad1ba87150e198be9ea32367a24e500e59de2c to < 953963b9ac5eecbb316617d337bfaa3d731e3c5eaffectedcfad1ba87150e198be9ea32367a24e500e59de2c to < 25519469972ef57c3edb1805dabd6c5612b90211affected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected5.10.267 to ≤ 5.10.*unaffected5.15.218 to ≤ 5.15.*unaffected6.1.185 to ≤ 6.1.*unaffected6.6.154 to ≤ 6.6.*unaffected6.12.106 to ≤ 6.12.*unaffected6.18.47 to ≤ 6.18.*unaffected7.1.11 to ≤ 7.1.*unaffected7.2.1 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c6de4241f2efbbab286efbb84a9c7190298b3052 ↗
- https://git.kernel.org/stable/c/92a6f0201bb68391b5eba1b3f330af007d7323b6 ↗
- https://git.kernel.org/stable/c/cb298672282421159e53ab311fe49d204c8a52da ↗
- https://git.kernel.org/stable/c/18f02354ed229b8e4561b580812d026e7eb29c85 ↗
- https://git.kernel.org/stable/c/e6397fe7b8b5ef18e051f49612d40ff476c5f7d9 ↗
- https://git.kernel.org/stable/c/d0902a7c454326c6384c614226ab8987f3fd425d ↗
- https://git.kernel.org/stable/c/dabfa26a208e56f4d8dbf26fddc48f188bdb0649 ↗
- https://git.kernel.org/stable/c/953963b9ac5eecbb316617d337bfaa3d731e3c5e ↗
- https://git.kernel.org/stable/c/25519469972ef57c3edb1805dabd6c5612b90211 ↗