In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: Fix uninit-value in ncidevup and ncintfpacket
syzbot reported the following uninit-value access issue [1][2]:
ncirxwork() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.
This patch resolved this issue by checking payload size before calling each message type handler codes.
[
{
"id": "CVE-2024-35915-4299674b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"290936063859513060195172420875170853653",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d24b03535e5eb82e025219c2f632b485409c898f",
"target": {
"file": "net/nfc/nci/core.c"
}
},
{
"id": "CVE-2024-35915-4ff478c4",
"signature_version": "v1",
"digest": {
"function_hash": "260825513912974096517233218174698050960",
"length": 803.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
}
},
{
"id": "CVE-2024-35915-74ca0969",
"signature_version": "v1",
"digest": {
"function_hash": "241794242845326750629300829434548977436",
"length": 850.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d24b03535e5eb82e025219c2f632b485409c898f",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
}
},
{
"id": "CVE-2024-35915-75f440b6",
"signature_version": "v1",
"digest": {
"function_hash": "241794242845326750629300829434548977436",
"length": 850.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
}
},
{
"id": "CVE-2024-35915-a957c2a8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"290936063859513060195172420875170853653",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a946ebee45b09294c8b0b0e77410b763c4d2817a",
"target": {
"file": "net/nfc/nci/core.c"
}
},
{
"id": "CVE-2024-35915-b9cc599b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5914041999889956331033025722611344395",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03fe259649a551d336a7f20919b641ea100e3fff",
"target": {
"file": "net/nfc/nci/core.c"
}
},
{
"id": "CVE-2024-35915-ee501a41",
"signature_version": "v1",
"digest": {
"function_hash": "260825513912974096517233218174698050960",
"length": 803.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac68d9fa09e410fa3ed20fb721d56aa558695e16",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
}
},
{
"id": "CVE-2024-35915-f24f0957",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5914041999889956331033025722611344395",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c",
"target": {
"file": "net/nfc/nci/core.c"
}
},
{
"id": "CVE-2024-35915-f32d283e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5914041999889956331033025722611344395",
"113281448830010851627569591421329423247",
"65434965959841998509009454684773042476"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac68d9fa09e410fa3ed20fb721d56aa558695e16",
"target": {
"file": "net/nfc/nci/core.c"
}
},
{
"id": "CVE-2024-35915-fd4c1c05",
"signature_version": "v1",
"digest": {
"function_hash": "260825513912974096517233218174698050960",
"length": 803.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03fe259649a551d336a7f20919b641ea100e3fff",
"target": {
"file": "net/nfc/nci/core.c",
"function": "nci_rx_work"
}
}
]