In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: llcp: bound the connect_sn TLV walk to the skb<\/p>\n
Commit 27256cdb290e (“nfc: llcp: bound SNL TLV parsing to the skb and
\nadd length checks”) fixed the unbounded TLV walk in nfc_llcp_recv_snl(),
\nand commit d8bd2dedbde5 (“nfc: llcp: fix OOB read and u8 offset wrap in
\nTLV parsers”) subsequently bounded nfc_llcp_parse_gb_tlv() and
\nnfc_llcp_parse_connection_tlv(). One sibling parser sharing the same
\npattern remains unbounded: nfc_llcp_connect_sn().<\/p>\n
nfc_llcp_connect_sn() walks a TLV list, reading a two-byte header
\n(type, length) followed by length bytes of value, without checking that
\nthe two header bytes or the declared length stay within the buffer. It
\nreturns a pointer to a service name of up to 255 bytes that may point
\npast the end of the skb; it is subsequently consumed by memcmp() in
\nnfc_llcp_sock_from_sn(). In addition tlv_array_len was computed as
\n“skb->len – LLCP_HEADER_SIZE” in size_t, so a CONNECT\/CC frame shorter
\nthan the LLCP header underflows to a huge length and the walk runs far
\npast the buffer.<\/p>\n
nfc_llcp_connect_sn() is reachable from nfc_llcp_recv_connect() and
\nnfc_llcp_recv_cc(), i.e. from received CONNECT and CC PDUs. A nearby
\nNFC device can reach this without authentication; LLCP link activation
\nhappens automatically after NFC-DEP, and the nfc_llcp_rx_skb()
\ndispatcher applies no minimum-length guard.<\/p>\n
Walk the TLV list by pointer, bounded by skb_tail_pointer(skb), and
\nvalidate each declared length before use, matching the approach already
\nused for nfc_llcp_recv_snl(). Starting the walk at
\n&skb->data[LLCP_HEADER_SIZE] against the tail pointer also removes the
\nsize_t underflow for short frames.<\/p>\n
Found by 0sec automated security-research tooling (https:\/\/0sec.ai).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: llcp: bound the connect_sn TLV walk to the skb<\/p>\n
Commit 27256cdb290e (“nfc: llcp: bound SNL TLV parsing to the skb and
\nadd leng<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17304","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}