Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug Fix both call sites by using %.*s with the explicit length to limit the output to the actual length of the string.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d9b8d8e19b073096d3609bbd60f82148d128b555 to < 75f7c5a42fa1483f5912279a749417c284ad708faffectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 6d4ca872830e46fcca9c086bf19fa9bd2faf09d2affectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < a143f7835faa4fe0178448289feea4f84eeee8d6affectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45baffectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 8afb6c194f5781798d3ab3edf243cf5a24a9d1f9affectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 8978dff632519712d1fa432991e1f2e857f90239affectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 4262b12277a3e056c95fc49e9c4d7bd97035d16caffectedd9b8d8e19b073096d3609bbd60f82148d128b555 to < 7dcf371a35632f035baf77bcf2c129165f772ce4affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/75f7c5a42fa1483f5912279a749417c284ad708f ↗
- https://git.kernel.org/stable/c/6d4ca872830e46fcca9c086bf19fa9bd2faf09d2 ↗
- https://git.kernel.org/stable/c/a143f7835faa4fe0178448289feea4f84eeee8d6 ↗
- https://git.kernel.org/stable/c/75bfd9ef4da2fb49dac1f19880d2ac4ccd07b45b ↗
- https://git.kernel.org/stable/c/8afb6c194f5781798d3ab3edf243cf5a24a9d1f9 ↗
- https://git.kernel.org/stable/c/8978dff632519712d1fa432991e1f2e857f90239 ↗
- https://git.kernel.org/stable/c/4262b12277a3e056c95fc49e9c4d7bd97035d16c ↗
- https://git.kernel.org/stable/c/7dcf371a35632f035baf77bcf2c129165f772ce4 ↗