PT-2026-61232 · Linux · Linux
CVE-2026-63915
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.8
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: fix out-of-bounds read in HCP header parsing
Both nfc hci recv from llc() and nci hci data received cb() read
packet->header from skb->data at function entry without first checking
that the buffer holds at least one byte. A malicious NFC peer can send
a 0-byte HCP frame that passes through the SHDLC layer and reaches
these functions, causing an out-of-bounds heap read of packet->header.
The same 0-byte frame, if queued as a non-final fragment, also causes
the reassembly loop to underflow msg len to UINT MAX, triggering
skb over panic() when the reassembled skb is written.
Fix this by adding a pskb may pull() check at the entry of each
function before packet->header is first accessed. The existing
pskb may pull() checks before the reassembled hcp skb is cast to
struct hcp packet remain in place to guard the 2-byte HCP message
header.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux