CVE-2022-48967

What it actually does

Missing bounds check in nci_add_new_protocol permits memcpy of up to 129 bytes into the 18-byte sensf_res field of struct nfc_target, enabling field-spanning write under CONFIG_FORTIFY_SOURCE.

Why it matters to the business

Systems relying on NFC in the Linux kernel face risk of memory corruption that can cause crashes or limited code execution; low EPSS and absence from KEV indicate modest immediate operational disruption despite the 726-day-old disclosure.

How an attack unfolds

An attacker supplies oversized NFC discovery or protocol data that reaches nci_add_new_protocol without length validation, triggering the oversized memcpy; similar Linux kernel flaws have appeared in 2024 espionage and financially motivated campaigns though this specific issue shows no confirmed exploitation.

How to fix it

Apply the upstream kernel patch containing commit f59e50f8ea596e641da8a0e9c7a33c0696bcbea5 or upgrade to a distribution kernel that includes the bounds checks; disable NFC kernel modules when the interface is unused.

How to confirm the fix worked

Inspect net/nfc/nci/ntf.c for the added length checks before the memcpy to sensf_res; re-run syzkaller or equivalent NFC fuzzing harness to confirm absence of the field-spanning write warning.

Typical attack path

1. Craft malicious NFC target advertisement or notification packet
2. Deliver packet to trigger nci_rx_work and subsequent ntf handling
3. Invoke nci_add_new_protocol with data exceeding sensf_res size
4. Overwrite adjacent kernel structures via the unsanitized memcpy

How to detect it

Review kernel logs for FORTIFY_SOURCE warnings mentioning memcpy and sensf_res; correlate with NFC subsystem activity or unexpected oops in nci/ntf.c paths.

What your security team should do

• Prioritize kernel updates on any hosts exposing NFC hardware or drivers
• Audit kernel configuration to ensure FORTIFY_SOURCE remains enabled
• Consider blacklisting nfc and related modules if NFC is not required
• Monitor EPSS trend for any future increase indicating rising exploit availability