AZL-99561

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: validate ATR_REQ length against the received frame

st21nfcatmrecvatrreq() checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE and that the self-declared atrreq->length is at least sizeof(struct st21nfcaatrreq), but never checks that atr_req->length does not exceed the actual received length (skb->len).

st21nfcatmsendatrres() then trusts the declared length:

gb_len = atr_req->length - sizeof(struct st21nfca_atr_req);
...
memcpy(atr_res->gbi, atr_req->gbi, gb_len);

so an RF peer that sends a short frame but sets atrreq->length larger than the frame makes gblen exceed the general bytes actually present, and the memcpy reads out of bounds past the received skb. Those bytes are placed in the ATR_RES and sent back to the peer (kernel-memory disclosure to a proximity attacker); a larger declared length is an out-of-bounds read (DoS).

Reject frames whose declared length exceeds the received length. The adjacent nfctmactivated() path in the same function already derives its general-bytes length from skb->len rather than the declared field.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.