Riskcovery

CVE-2024-35915

nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet

State
Published
Severity
8.8 High
Published
May 19, 2024
Updated
Oct 15, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet

syzbot reported the following uninit-value access issue [1][2]:

nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.

This patch resolved this issue by checking payload size before calling each message type handler codes.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 11387b2effbb55f58dc2111ef4b4b896f2756240Affected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 03fe259649a551d336a7f20919b641ea100e3fffAffected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 755e53bbc61bc1aff90eafa64c8c2464fd3dfa3cAffected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before ac68d9fa09e410fa3ed20fb721d56aa558695e16Affected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7Affected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before a946ebee45b09294c8b0b0e77410b763c4d2817aAffected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before 8948e30de81faee87eeee01ef42a1f6008f5a83aAffected
  • 6a2968aaf50c7a22fced77a5e24aa636281efca8 to before d24b03535e5eb82e025219c2f632b485409c898fAffected
LinuxLinux
  • 3.2Affected
  • before 3.2Not affected
  • 4.19.312 through 4.19.*Not affected
  • 5.4.274 through 5.4.*Not affected
  • 5.10.215 through 5.10.*Not affected
  • 5.15.154 through 5.15.*Not affected
  • 6.1.85 through 6.1.*Not affected
  • 6.6.26 through 6.6.*Not affected
  • 6.8.5 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.