High · published June 21, 2024
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: Fix uninit-value in nci_rx_work
syzbot reported the following uninit-value access issue [1]
nci_rx_work() parses received packet from ndev->rx_q. It should be
validated header size, payload size and total packet size before
processing the packet. If an invalid packet is detected, it should be
silently discarded.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.19.312, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 5.4.274, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.10.215, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.15.154, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 6.1.85, < 6.1.93 | 6.1.93 |
| linux/linux_kernel | ≥ 6.6.26, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.8.5, < 6.9.4 | 6.9.4 |