CVE-2024-35915

What it actually does

In the Linux kernel NFC NCI subsystem, nci_rx_work() processes incoming packets without validating payload length; zero-length payloads cause message type handlers to read uninitialized memory, resulting in KMSAN-detected uninit-value access.

Why it matters to the business

Kernel stability issues on Linux systems handling NFC traffic can lead to crashes or unexpected behavior, increasing operational risk for devices and servers using affected kernels; the issue has been public for over two years with no widespread exploitation observed.

How an attack unfolds

An attacker with local or network-adjacent access sends NFC packets containing zero-length payloads to nci_rx_work(); the missing length check allows handlers to dereference uninitialized data, potentially causing denial-of-service or facilitating further memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 11387b2effbb55f58dc2111ef4b4b896f2756240 or later; rebuild and reboot affected systems; disable NFC kernel modules if not required.

How to confirm the fix worked

Confirm the running kernel contains commit 11387b2effbb55f58dc2111ef4b4b896f2756240; attempt to reproduce the original zero-payload packet scenario and verify no uninit-value reports occur under KMSAN or similar tooling.

Typical attack path

1. Identify a Linux system exposing NFC interfaces or allowing crafted packet injection
2. Craft and transmit an NFC NCI packet with explicitly zero payload length
3. Trigger nci_rx_work() processing path without prior length validation
4. Observe kernel memory access violation or system instability

How to detect it

Inspect kernel logs for KMSAN or UBSAN reports mentioning nci_dev_up, nci_ntf_packet, or nci_rx_work with uninitialized value warnings; correlate with unexpected NFC packet reception in system traces.

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on all exposed systems
• Review and restrict unnecessary NFC functionality via kernel configuration
• Monitor for future kernel updates addressing related NFC issues