AZL-99596

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: bound the connect_sn TLV walk to the skb

Commit 27256cdb290e ("nfc: llcp: bound SNL TLV parsing to the skb and add length checks") fixed the unbounded TLV walk in nfcllcprecvsnl(), and commit d8bd2dedbde5 ("nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers") subsequently bounded nfcllcpparsegbtlv() and nfcllcpparseconnectiontlv(). One sibling parser sharing the same pattern remains unbounded: nfcllcpconnectsn().

nfcllcpconnectsn() walks a TLV list, reading a two-byte header (type, length) followed by length bytes of value, without checking that the two header bytes or the declared length stay within the buffer. It returns a pointer to a service name of up to 255 bytes that may point past the end of the skb; it is subsequently consumed by memcmp() in nfcllcpsockfromsn(). In addition tlvarraylen was computed as "skb->len - LLCPHEADERSIZE" in sizet, so a CONNECT/CC frame shorter than the LLCP header underflows to a huge length and the walk runs far past the buffer.

nfcllcpconnectsn() is reachable from nfcllcprecvconnect() and nfcllcprecvcc(), i.e. from received CONNECT and CC PDUs. A nearby NFC device can reach this without authentication; LLCP link activation happens automatically after NFC-DEP, and the nfcllcprxskb() dispatcher applies no minimum-length guard.

Walk the TLV list by pointer, bounded by skbtailpointer(skb), and validate each declared length before use, matching the approach already used for nfcllcprecvsnl(). Starting the walk at &skb->data[LLCPHEADERSIZE] against the tail pointer also removes the sizet underflow for short frames.

Found by 0sec automated security-research tooling (https://0sec.ai).