In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: Fix uninit-value in ncidevup and ncintfpacket
syzbot reported the following uninit-value access issue [1][2]:
ncirxwork() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.
This patch resolved this issue by checking payload size before calling each message type handler codes.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35915.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-35915-75f440b6",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
},
"digest": {
"length": 850.0,
"function_hash": "241794242845326750629300829434548977436"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-35915-a957c2a8",
"target": {
"file": "net/nfc/nci/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"290936063859513060195172420875170853653",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35915.json"