CVE-2024-38381: nfc: nci: Fix uninit-value in nci_rx_work
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: Fix uninit-value in ncirxwork
syzbot reported the following uninit-value access issue [1]
ncirxwork() parses received packet from ndev->rxq. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38381?
CVE-2024-38381 is categorized as a vulnerability in the Linux kernel related to uninitialized value access.
How do I fix CVE-2024-38381?
To fix CVE-2024-38381, upgrade your Linux kernel to one of the patched versions such as 5.10.223-1, 5.10.226-1, 6.1.123-1, among others.
Which versions of the Linux kernel are affected by CVE-2024-38381?
CVE-2024-38381 affects multiple versions of the Linux kernel from 4.19.312 to 6.19.316 and several specific 5.x and 6.x versions.
What component of the Linux kernel does CVE-2024-38381 impact?
CVE-2024-38381 impacts the NFC subsystem, specifically the nci_rx_work function which processes received packets.
Is CVE-2024-38381 already resolved?
Yes, CVE-2024-38381 has been resolved with patches available for affected versions.