In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()<\/p>\n
nci_target_auto_activated() appends a target to the fixed-size array
\nndev->targets[NCI_MAX_DISCOVERED_TARGETS] and increments ndev->n_targets
\nwithout first checking the array is full; unlike its sibling
\nnci_add_new_target(), which bails out when n_targets already equals
\nNCI_MAX_DISCOVERED_TARGETS.<\/p>\n
ndev->n_targets is only cleared by nci_clear_target_list(), so an NFCC
\nthat repeatedly re-runs discovery (RF_DISCOVER_RSP, which re-enters
\nNCI_DISCOVERY without clearing the target list) and reports an
\nauto-activated target (RF_INTF_ACTIVATED_NTF) drives n_targets past the
\nlimit. The append then writes a struct nfc_target past the end of the
\narray (a slab out-of-bounds write), and nfc_targets_found() goes on to
\nwalk the array with the inflated count:<\/p>\n
BUG: KASAN: slab-out-of-bounds in nci_add_new_protocol+0x94\/0x2ac [nci]
\n Write of size 2 at addr ffff0000c7299a18 by task kworker\/u8:0\/12
\n Workqueue: nfc0_nci_rx_wq nci_rx_work [nci]
\n Call trace:
\n nci_add_new_protocol+0x94\/0x2ac [nci]
\n nci_ntf_packet+0xddc\/0x11a0 [nci]
\n nci_rx_work+0x15c\/0x1e0 [nci]
\n process_one_work+0x2dc\/0x500
\n worker_thread+0x240\/0x460
\n kthread+0x1c0\/0x1d0
\n ret_from_fork+0x10\/0x20<\/p>\n
The buggy address belongs to the cache kmalloc-2k of size 2048
\n The buggy address is located 1024 bytes to the right of
\n allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)<\/p>\n
Guard nci_target_auto_activated() with the same check used by
\nnci_add_new_target().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()<\/p>\n
nci_target_auto_activated() appends a target to the fixed-size ar<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17299","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}