In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse
the CORE_INIT_RSP packet without validating that the skb contains
enough data. A malformed response (e.g. injected via virtual_ncidev)
can declare a large num_supported_rf_interfaces while providing
insufficient data, causing reads of uninitialized slab memory. This
is later used in nci_init_complete_req(), triggering a KMSAN
uninit-value warning.
Add skb length checks before accessing packet fields:
– Validate the skb has at least 1 byte for the status field.
– Validate the skb can hold the fixed-size header before parsing.
– In v2, bounds-check each variable-length rf_interface entry and its
extension parameters within the parsing loop.
– In v1, verify the skb is large enough for both the variable-length
rf_interfaces array and the trailing rsp_2 structure.
