481 lines
23 KiB
JSON
481 lines
23 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-38381",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-06-21T10:12:11.547Z",
|
||
"datePublished": "2024-06-21T10:18:12.302Z",
|
||
"dateUpdated": "2026-10-15T00:43:18.545Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T11:32:33.123Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_rx_work\n\nsyzbot reported the following uninit-value access issue [1]\n\nnci_rx_work() parses received packet from ndev->rx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:A - The NCI RX path parses frames delivered by the NFC controller, which are driven by the NFC air interface, so a rogue tag/peer or NFCC within NFC radio range reaches this code. This matches the kernel CNA's established AV:A treatment of NCI packet-parsing bugs, including the direct follow-ups to this very `nci_valid_size()` helper (CVE-2025-40043, CVE-2026-43291).\nAC:L - Triggering only requires delivering a truncated NCI frame (`skb->len < 3`, or `skb->len < 3 + plen`); there is no race, no timing window, and no memory-layout precondition the attacker cannot influence. The condition is deterministic and reproducible on every frame.\nPR:N - `nci_recv_frame()` queues frames and `nci_rx_work()` parses them with no capability, credential, or authentication check anywhere on the path — NFC peering is entirely unauthenticated. No privileges of any kind are needed.\nUI:N - Parsing happens asynchronously in the `rx_wq` workqueue as soon as a frame arrives; no victim action is required beyond the NFC stack being active in its normal discovery/polling state.\nS:U - The out-of-bounds reads, the resulting state corruption, and the downstream heap overflow all occur within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Handlers read up to ~260 bytes past a small heap object (e.g. `rsp_2 = skb->data + 6 + num_supported_rf_interfaces` with an uncontrolled 0–255 offset), and those bytes are copied into `ndev->targets[]` and `ndev->remote_gb`, which are exported to userspace via NFC netlink `NFC_EVENT_TARGETS_FOUND` and LLCP — a direct kernel-memory disclosure primitive.\nI:H - Out-of-bounds bytes are written into kernel state (`conn_info->max_pkt_payload_len`, `ndev->max_ctrl_pkt_payload_len`, `credits_cnt`), and a garbage `max_pkt_payload_len` makes `len = max_pkt_payload_len - skb->len - 1` in `nci_hci_send_data()` underflow, driving `skb_put_data()` past the skb tail for a heap out-of-bounds write.\nA:H - The unbounded reads (`skb->data[-1]` on a zero-length skb, and a 0–255-byte uncontrolled pointer offset) fault or trip KASAN, and the derived length underflow corrupts the heap, producing an oops or panic that is repeatable on demand."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/nfc/nci/core.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "11387b2effbb55f58dc2111ef4b4b896f2756240",
|
||
"lessThan": "406cfac9debd4a6d3dc5d9258ee086372a8c08b6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "03fe259649a551d336a7f20919b641ea100e3fff",
|
||
"lessThan": "485ded868ed62ceb2acb3a459d7843fd71472619",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c",
|
||
"lessThan": "f80b786ab0550d0020191a59077b2c7e069db2d1",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "ac68d9fa09e410fa3ed20fb721d56aa558695e16",
|
||
"lessThan": "ad4d196d2008c7f413167f0a693feb4f0439d7fe",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7",
|
||
"lessThan": "e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a946ebee45b09294c8b0b0e77410b763c4d2817a",
|
||
"lessThan": "e53a7f8afcbd2886f2a94c5d56757328109730ea",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "d24b03535e5eb82e025219c2f632b485409c898f",
|
||
"lessThan": "017ff397624930fd7ac7f1761f3c9d6a7100f68c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "d24b03535e5eb82e025219c2f632b485409c898f",
|
||
"lessThan": "e4a87abf588536d1cdfb128595e6e680af5cf3ed",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "8948e30de81faee87eeee01ef42a1f6008f5a83a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "4.19.312",
|
||
"lessThan": "4.19.316",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.274",
|
||
"lessThan": "5.4.278",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.215",
|
||
"lessThan": "5.10.219",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.154",
|
||
"lessThan": "5.15.161",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.85",
|
||
"lessThan": "6.1.93",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.26",
|
||
"lessThan": "6.6.33",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.8.5",
|
||
"lessThan": "6.9",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/nfc/nci/core.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "6.9",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "6.9",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.316",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.278",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.219",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.161",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.93",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.33",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.9.4",
|
||
"lessThanOrEqual": "6.9.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.10",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19.312",
|
||
"versionEndExcluding": "4.19.316"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.4.274",
|
||
"versionEndExcluding": "5.4.278"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.10.215",
|
||
"versionEndExcluding": "5.10.219"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.15.154",
|
||
"versionEndExcluding": "5.15.161"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1.85",
|
||
"versionEndExcluding": "6.1.93"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.6.26",
|
||
"versionEndExcluding": "6.6.33"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.9",
|
||
"versionEndExcluding": "6.9.4"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.9",
|
||
"versionEndExcluding": "6.10"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.8.5"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"
|
||
}
|
||
],
|
||
"title": "nfc: nci: Fix uninit-value in nci_rx_work",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2025-11-04T17:21:21.599Z"
|
||
}
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2024-38381",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-09-10T17:09:25.051432Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-11T17:34:45.388Z"
|
||
}
|
||
},
|
||
{
|
||
"x_adpType": "supplier",
|
||
"providerMetadata": {
|
||
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
||
"shortName": "siemens-SADP",
|
||
"dateUpdated": "2026-10-15T00:43:18.545Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "RUGGEDCOM RST2428P",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "V3.1",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
|
||
"versions": [
|
||
{
|
||
"status": "unaffected",
|
||
"version": "0",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "V3.1",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "V1.1.1",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
|
||
},
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"dataVersion": "5.2"
|
||
} |