In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 6.1.85-1 | linux_6.1.85-1_all.deb |
Debian | 11 | all | linux | < 5.10.216-1 | linux_5.10.216-1_all.deb |
Debian | 10 | all | linux | < 4.19.316-1 | linux_4.19.316-1_all.deb |
Debian | 999 | all | linux | < 6.8.9-1 | linux_6.8.9-1_all.deb |
Debian | 13 | all | linux | < 6.8.9-1 | linux_6.8.9-1_all.deb |
Debian | 10 | all | linux-5.10 | < 5.10.216-1~deb10u1 | linux-5.10_5.10.216-1~deb10u1_all.deb |