In the Linux kernel, the following vulnerability has been resolved:
NFC: nci: Bounds check struct nfc_target arrays
While running under CONFIGFORTIFYSOURCE=y, syzkaller reported:
memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)
This appears to be a legitimate lack of bounds checking in nciaddnew_protocol(). Add the missing checks.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908b2da426fe9c3ce74cf541ba40e7a4251db191",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-0a1bef72",
"signature_version": "v1",
"digest": {
"length": 2069.0,
"function_hash": "202269233265654113784056249097402520287"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b37f0dc0638d13a006f2f24d2f6ca61e83bc714",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-2a2deff9",
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "99629153488011526271217402223558463025"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-2cc565d7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cff35329070b96b4484d23f9f48a5ca2c947e750",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-322239df",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e329e71013c9b5a4535b099208493c7826ee4a64",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-48808130",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e329e71013c9b5a4535b099208493c7826ee4a64",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-744b0bdf",
"signature_version": "v1",
"digest": {
"length": 2069.0,
"function_hash": "202269233265654113784056249097402520287"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908b2da426fe9c3ce74cf541ba40e7a4251db191",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-78e1111d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f41547546db9af99da2c34e3368664d7a79cefae",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-7bf6c54e",
"signature_version": "v1",
"digest": {
"length": 2069.0,
"function_hash": "202269233265654113784056249097402520287"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6778434706940b8fad7ef35f410d2b9929f256d2",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-a00fe89e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b37f0dc0638d13a006f2f24d2f6ca61e83bc714",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-a7b8cb9f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f41547546db9af99da2c34e3368664d7a79cefae",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-adccdb7a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cff35329070b96b4484d23f9f48a5ca2c947e750",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-b074cd10",
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "99629153488011526271217402223558463025"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdcfb9f6748218a149f62468d6297ce3f014e9c",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-c2b59889",
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "99629153488011526271217402223558463025"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdcfb9f6748218a149f62468d6297ce3f014e9c",
"target": {
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-e9bcfd66",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43320320813037384945613453032401015181",
"321074507401039535210748222575384523902",
"321354039247729617012930631953310557588",
"285874219906150675938115169694403856201",
"69702685716213202413469949710393248596",
"37599636785403754348235355011838622379",
"298780231982504111976337017370313739954",
"81840309057633166006131017208753539909",
"132480672998031168852603176688924686098",
"75399333533270081559876006390381044393",
"300565564346302363605982660573468923496",
"87835225741271356354699828219476229124"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-e9e55a8e",
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "99629153488011526271217402223558463025"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6778434706940b8fad7ef35f410d2b9929f256d2",
"target": {
"function": "nci_add_new_protocol",
"file": "net/nfc/nci/ntf.c"
},
"deprecated": false,
"id": "CVE-2022-48967-f40076ec",
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "99629153488011526271217402223558463025"
},
"signature_type": "Function"
}
]