CVE-2024-35915

2024-05-1909:15:11

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

cve-2024-35915

vulnerability

nfc

nci

uninit-value

syzbot

payload length

kmsan

packet

message type handler's codes

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet

syzbot reported the following uninit-value access issue [1][2]:

nci_rx_work() parses and processes received packet. When the payload
length is zero, each message type handler reads uninitialized payload
and KMSAN detects this issue. The receipt of a packet with a zero-size
payload is considered unexpected, and therefore, such packets should be
silently discarded.

This patch resolved this issue by checking payload size before calling
each message type handler codes.

Affected configurations

Vulners

Node

linuxlinux_kernelRange3.2–4.19.312

linuxlinux_kernelRange4.20.0–5.4.274

linuxlinux_kernelRange5.5.0–5.10.215

linuxlinux_kernelRange5.11.0–5.15.154

linuxlinux_kernelRange5.16.0–6.1.85

linuxlinux_kernelRange6.2.0–6.6.26

linuxlinux_kernelRange6.7.0–6.8.5

linuxlinux_kernelRange6.9.0≥

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/nfc/nci/core.c"
    ],
    "versions": [
      {
        "version": "6a2968aaf50c",
        "lessThan": "11387b2effbb",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "03fe259649a5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "755e53bbc61b",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "ac68d9fa09e4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "b51ec7fc9f87",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "a946ebee45b0",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "8948e30de81f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6a2968aaf50c",
        "lessThan": "d24b03535e5e",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/nfc/nci/core.c"
    ],
    "versions": [
      {
        "version": "3.2",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.2",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "4.19.312",
        "lessThanOrEqual": "4.19.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.274",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.215",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.154",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.85",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.26",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.5",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]