{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-35915", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-35915" ], "published": "2024-05-19T08:35:32Z", "summary": "nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.85", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-35915" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.8, "cvss_v3_severity": "High", "scenario": "AV:A - NCI control/notification frames are delivered to `nci_rx_work()` by the NFC controller whose notification stream is driven by an NFC peer/tag in adjacent RF range, and the same parser is fed by the N_NCI tty line discipline and /dev/virtual_nci on the local host. This matches the kernel CNA's scoring of the directly related NCI packet-validation fixes (CVE-2025-40043, CVE-2026-43291, CVE-2026-63915) as Adjacent.\nAC:L - Triggering only requires that a single NCI frame with a zero payload length field reach the RX queue; the missing check is unconditional, with no race, timing window, or memory-layout precondition. Every dispatch through `nci_rsp_packet()`/`nci_ntf_packet()` then reads past the received data deterministically.\nPR:N - The RF-side path requires no authentication or privileges of any kind \u2014 an NFC peer in range needs no credentials, and the NCI parser runs before any application-level policy. The local fallbacks (N_NCI ldisc via TIOCSETD on a pty) are reachable by an ordinary unprivileged user.\nUI:N - Frames are consumed by the `nci_rx_work` workqueue as soon as they are queued by `nci_recv_frame()`; NFC polling/discovery runs autonomously on the device. No victim action is needed.\nS:U - The uninitialized reads, out-of-bounds accesses, and state corruption are all confined to kernel memory and the NFC device state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized/out-of-bounds heap bytes are memcpy'd into `nfc_target.nfcid1`, `sensb_res`, and `sensf_res` by `nci_extract_rf_params_*()` and then exported to userspace by `nfc_genl_send_target()` as netlink attributes, a direct kernel heap information leak; `nci_core_init_rsp_packet_v1()` additionally reads up to ~270 bytes past the payload via an uninitialized `num_supported_rf_interfaces` offset.\nI:H - `nci_core_conn_credits_ntf_packet()` writes `conn_entries[i].conn_id` back into the skb beyond the received payload and adds uninitialized credit values to connection flow control, while uninit values are stored into `ndev->nci_ver`, `max_ctrl_pkt_payload_len`, `supported_rf_interfaces`, and `manufact_specific_info`, corrupting kernel state used by subsequent parsing and transmission decisions.\nA:H - Out-of-bounds reads past the skb buffer and the corrupted length/interface counts driving further parsing can fault or oops the kernel, and the poisoned NCI device state (credit counters, `nci_ver`, packet length limits) leaves the NFC stack in an inconsistent state. Any such memory-safety error in softirq/workqueue context is a full kernel crash." } } }