In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: nci: fix uninit-value in the RF discover\/activated NTF handlers<\/p>\n
nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() each
\nparse a notification into an on-stack struct (nci_rf_discover_ntf \/
\nnci_rf_intf_activated_ntf) that is not initialised. The RF
\ntechnology-specific parameters are only extracted when
\nrf_tech_specific_params_len is non-zero, so a notification that reports a
\nzero length leaves the rf_tech_specific_params union uninitialised – and
\nboth handlers then pass it to nci_add_new_protocol(), which reads it:<\/p>\n
– discover: nci_add_new_target() -> nci_add_new_protocol();
\n – activated: nci_target_auto_activated() -> nci_add_new_protocol().<\/p>\n
nci_add_new_protocol() uses nfca_poll->nfcid1_len as both a branch
\ncondition and a memcpy() length and copies nfcid1\/sens_res\/sel_res into
\nndev->targets, which is later exposed to user space via NFC_CMD_GET_TARGET.<\/p>\n
BUG: KMSAN: uninit-value in nci_add_new_protocol+0x624\/0x6c0
\n nci_add_new_protocol+0x624\/0x6c0
\n nci_ntf_packet+0x25b2\/0x3c30
\n nci_rx_work+0x318\/0x5d0
\n process_scheduled_works+0x84b\/0x17a0
\n worker_thread+0xc10\/0x11b0
\n kthread+0x376\/0x500
\n Local variable ntf.i created at:
\n nci_ntf_packet+0xbc2\/0x3c30<\/p>\n
Zero-initialise both on-stack notifications so the union reads back as
\nzero when no technology-specific parameters are present.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: nci: fix uninit-value in the RF discover\/activated NTF handlers<\/p>\n
nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_pa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17298","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}