In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: Fix uninit-value in ncidevup and ncintfpacket
syzbot reported the following uninit-value access issue [1][2]:
ncirxwork() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.
This patch resolved this issue by checking payload size before calling each message type handler codes.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "290936063859513060195172420875170853653", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8948e30de81faee87eeee01ef42a1f6008f5a83a", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-26c97ff7", "signature_type": "Line" }, { "digest": { "length": 803.0, "function_hash": "260825513912974096517233218174698050960" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11387b2effbb55f58dc2111ef4b4b896f2756240", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-2c4b6ea7", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "290936063859513060195172420875170853653", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d24b03535e5eb82e025219c2f632b485409c898f", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-4299674b", "signature_type": "Line" }, { "digest": { "length": 803.0, "function_hash": "260825513912974096517233218174698050960" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-440f5794", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "5914041999889956331033025722611344395", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11387b2effbb55f58dc2111ef4b4b896f2756240", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-4b248d1f", "signature_type": "Line" }, { "digest": { "length": 850.0, "function_hash": "241794242845326750629300829434548977436" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d24b03535e5eb82e025219c2f632b485409c898f", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-74ca0969", "signature_type": "Function" }, { "digest": { "length": 850.0, "function_hash": "241794242845326750629300829434548977436" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-75f440b6", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "290936063859513060195172420875170853653", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-a957c2a8", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "5914041999889956331033025722611344395", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03fe259649a551d336a7f20919b641ea100e3fff", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-b9cc599b", "signature_type": "Line" }, { "digest": { "length": 850.0, "function_hash": "241794242845326750629300829434548977436" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8948e30de81faee87eeee01ef42a1f6008f5a83a", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-d2601078", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "5914041999889956331033025722611344395", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-edc4b174", "signature_type": "Line" }, { "digest": { "length": 803.0, "function_hash": "260825513912974096517233218174698050960" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac68d9fa09e410fa3ed20fb721d56aa558695e16", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-ee501a41", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "5914041999889956331033025722611344395", "113281448830010851627569591421329423247", "65434965959841998509009454684773042476" ] }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac68d9fa09e410fa3ed20fb721d56aa558695e16", "target": { "file": "net/nfc/nci/core.c" }, "id": "CVE-2024-35915-f32d283e", "signature_type": "Line" }, { "digest": { "length": 803.0, "function_hash": "260825513912974096517233218174698050960" }, "signature_version": "v1", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03fe259649a551d336a7f20919b641ea100e3fff", "target": { "file": "net/nfc/nci/core.c", "function": "nci_rx_work" }, "id": "CVE-2024-35915-fd4c1c05", "signature_type": "Function" } ] }