CVE-2022-48967

NFC: nci: Bounds check struct nfc_target arrays

State: Published
Severity: 8.8 High
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Aug 22, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Bounds check struct nfc_target arrays

While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:

memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)

This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 6b37f0dc0638d13a006f2f24d2f6ca61e83bc714Affected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before dbdcfb9f6748218a149f62468d6297ce3f014e9cAffected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before cff35329070b96b4484d23f9f48a5ca2c947e750Affected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 6778434706940b8fad7ef35f410d2b9929f256d2Affected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9Affected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 908b2da426fe9c3ce74cf541ba40e7a4251db191Affected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before f41547546db9af99da2c34e3368664d7a79cefaeAffected 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before e329e71013c9b5a4535b099208493c7826ee4a64Affected
LinuxLinux	3.4Affected before 3.4Not affected 4.9.336 through 4.9.Not affected 4.14.302 through 4.14.Not affected 4.19.269 through 4.19.Not affected 5.4.227 through 5.4.Not affected 5.10.159 through 5.10.Not affected 5.15.83 through 5.15.Not affected 6.0.13 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 6b37f0dc0638d13a006f2f24d2f6ca61e83bc714Affected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before dbdcfb9f6748218a149f62468d6297ce3f014e9cAffected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before cff35329070b96b4484d23f9f48a5ca2c947e750Affected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 6778434706940b8fad7ef35f410d2b9929f256d2Affected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9Affected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before 908b2da426fe9c3ce74cf541ba40e7a4251db191Affected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before f41547546db9af99da2c34e3368664d7a79cefaeAffected
019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 to before e329e71013c9b5a4535b099208493c7826ee4a64Affected

LinuxLinux

3.4Affected
before 3.4Not affected
4.9.336 through 4.9.*Not affected
4.14.302 through 4.14.*Not affected
4.19.269 through 4.19.*Not affected
5.4.227 through 5.4.*Not affected
5.10.159 through 5.10.*Not affected
5.15.83 through 5.15.*Not affected
6.0.13 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.