CVE-2024-38381

What it actually does

Missing size validation on packets dequeued from ndev->rx_q allows nci_rx_work to process malformed NCI headers, resulting in uninitialized memory being read and used during packet handling.

Why it matters to the business

Local attackers on affected Linux systems can trigger memory corruption that may expose sensitive kernel data or cause denial of service, increasing risk on any device or server running vulnerable kernels with NFC support enabled.

How an attack unfolds

An attacker with local access crafts and injects invalid packets into the NFC receive queue; nci_rx_work dequeues the packet without checking header, payload, or total length, then reads uninitialized memory while parsing it.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.19.316 or commit 406cfac9debd4a6d3dc5d9258ee086372a8c08b6 (or later stable releases containing the fix). Disable NFC functionality if the feature is not required.

How to confirm the fix worked

Confirm the running kernel version is at or above the listed fixed releases; review the nci_rx_work function for the added size validation checks on header, payload, and total packet length before processing.

Typical attack path

1. Obtain local code execution or shell access on the target system
2. Prepare and enqueue a malformed NCI packet via the rx_q interface
3. Trigger nci_rx_work processing of the invalid packet
4. Read or corrupt kernel memory through the resulting uninit-value access

How to detect it

Review kernel logs and dmesg output around nci_rx_work calls for uninitialized-value warnings or crashes; examine audit logs for unexpected local processes interacting with NFC device nodes.

What your security team should do

• Apply the kernel update to all affected systems as soon as possible
• Audit systems for NFC kernel module usage and disable it where unnecessary
• Monitor for future kernel updates that address similar input-validation issues