CVE-2024-42130: nfc/nci: Add the inconsistency check between the input data length and count
In the Linux kernel, the following vulnerability has been resolved:
nfc/nci: Add the inconsistency check between the input data length and count
write$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="610501"], 0xf)
Syzbot constructed a write() call with a data length of 3 bytes but a count value of 15, which passed too little data to meet the basic requirements of the function ncirfintfactivatedntfpacket().
Therefore, increasing the comparison between data length and count value to avoid problems caused by inconsistent data length and count.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42130?
CVE-2024-42130 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-42130?
To fix CVE-2024-42130, update to versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1 of the Linux kernel.
Which Linux kernel versions are affected by CVE-2024-42130?
CVE-2024-42130 affects Linux kernel versions up to and including 5.10.226-1.
Is there a known exploit for CVE-2024-42130?
As of now, there are no publicly known exploits for CVE-2024-42130.
What components of the Linux kernel does CVE-2024-42130 impact?
CVE-2024-42130 impacts the NFC (Near Field Communication) subsystem of the Linux kernel.