In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: st21nfca: validate ATR_REQ length against the received frame<\/p>\n
st21nfca_tm_recv_atr_req() checks that the received ATR_REQ frame is at
\nleast ST21NFCA_ATR_REQ_MIN_SIZE and that the self-declared atr_req->length
\nis at least sizeof(struct st21nfca_atr_req), but never checks that
\natr_req->length does not exceed the actual received length (skb->len).<\/p>\n
st21nfca_tm_send_atr_res() then trusts the declared length:<\/p>\n
\tgb_len = atr_req->length – sizeof(struct st21nfca_atr_req);
\n\t…
\n\tmemcpy(atr_res->gbi, atr_req->gbi, gb_len);<\/p>\n
so an RF peer that sends a short frame but sets atr_req->length larger
\nthan the frame makes gb_len exceed the general bytes actually present,
\nand the memcpy reads out of bounds past the received skb. Those bytes are
\nplaced in the ATR_RES and sent back to the peer (kernel-memory disclosure
\nto a proximity attacker); a larger declared length is an out-of-bounds
\nread (DoS).<\/p>\n
Reject frames whose declared length exceeds the received length. The
\nadjacent nfc_tm_activated() path in the same function already derives its
\ngeneral-bytes length from skb->len rather than the declared field.<\/p>\n
Found by 0sec (https:\/\/0sec.ai) using automated source analysis; the
\nmissing bound is evident from source. Compile-tested.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfc: st21nfca: validate ATR_REQ length against the received frame<\/p>\n
st21nfca_tm_recv_atr_req() checks that the received ATR_REQ fram<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17327","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}