CVE-2024-35915

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-35915", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.122Z", "datePublished": "2024-05-19T08:35:08.239Z", "dateUpdated": "2026-10-15T00:41:24.840Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:57.434Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - NCI control/notification frames are delivered to `nci_rx_work()` by the NFC controller whose notification stream is driven by an NFC peer/tag in adjacent RF range, and the same parser is fed by the N_NCI tty line discipline and /dev/virtual_nci on the local host. This matches the kernel CNA's scoring of the directly related NCI packet-validation fixes (CVE-2025-40043, CVE-2026-43291, CVE-2026-63915) as Adjacent.\nAC:L - Triggering only requires that a single NCI frame with a zero payload length field reach the RX queue; the missing check is unconditional, with no race, timing window, or memory-layout precondition. Every dispatch through `nci_rsp_packet()`/`nci_ntf_packet()` then reads past the received data deterministically.\nPR:N - The RF-side path requires no authentication or privileges of any kind \u2014 an NFC peer in range needs no credentials, and the NCI parser runs before any application-level policy. The local fallbacks (N_NCI ldisc via TIOCSETD on a pty) are reachable by an ordinary unprivileged user.\nUI:N - Frames are consumed by the `nci_rx_work` workqueue as soon as they are queued by `nci_recv_frame()`; NFC polling/discovery runs autonomously on the device. No victim action is needed.\nS:U - The uninitialized reads, out-of-bounds accesses, and state corruption are all confined to kernel memory and the NFC device state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized/out-of-bounds heap bytes are memcpy'd into `nfc_target.nfcid1`, `sensb_res`, and `sensf_res` by `nci_extract_rf_params_*()` and then exported to userspace by `nfc_genl_send_target()` as netlink attributes, a direct kernel heap information leak; `nci_core_init_rsp_packet_v1()` additionally reads up to ~270 bytes past the payload via an uninitialized `num_supported_rf_interfaces` offset.\nI:H - `nci_core_conn_credits_ntf_packet()` writes `conn_entries[i].conn_id` back into the skb beyond the received payload and adds uninitialized credit values to connection flow control, while uninit values are stored into `ndev->nci_ver`, `max_ctrl_pkt_payload_len`, `supported_rf_interfaces`, and `manufact_specific_info`, corrupting kernel state used by subsequent parsing and transmission decisions.\nA:H - Out-of-bounds reads past the skb buffer and the corrupted length/interface counts driving further parsing can fault or oops the kernel, and the poisoned NCI device state (credit counters, `nci_ver`, packet length limits) leaves the NFC stack in an inconsistent state. Any such memory-safety error in softirq/workqueue context is a full kernel crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/nci/core.c"], "versions": [{"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "11387b2effbb55f58dc2111ef4b4b896f2756240", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "03fe259649a551d336a7f20919b641ea100e3fff", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "status": "affected", "versionType": "git"}, {"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "d24b03535e5eb82e025219c2f632b485409c898f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/nci/core.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.85", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "4.19.312"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"}, {"url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"}, {"url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"}, {"url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"}, {"url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"}, {"url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"}, {"url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"}, {"url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"}], "title": "nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T17:12:44.324505Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:39.499Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.232Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:41:24.840Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.232Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:41:24.840Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T17:12:44.324505Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.041Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - NCI control/notification frames are delivered to `nci_rx_work()` by the NFC controller whose notification stream is driven by an NFC peer/tag in adjacent RF range, and the same parser is fed by the N_NCI tty line discipline and /dev/virtual_nci on the local host. This matches the kernel CNA's scoring of the directly related NCI packet-validation fixes (CVE-2025-40043, CVE-2026-43291, CVE-2026-63915) as Adjacent.\nAC:L - Triggering only requires that a single NCI frame with a zero payload length field reach the RX queue; the missing check is unconditional, with no race, timing window, or memory-layout precondition. Every dispatch through `nci_rsp_packet()`/`nci_ntf_packet()` then reads past the received data deterministically.\nPR:N - The RF-side path requires no authentication or privileges of any kind \u2014 an NFC peer in range needs no credentials, and the NCI parser runs before any application-level policy. The local fallbacks (N_NCI ldisc via TIOCSETD on a pty) are reachable by an ordinary unprivileged user.\nUI:N - Frames are consumed by the `nci_rx_work` workqueue as soon as they are queued by `nci_recv_frame()`; NFC polling/discovery runs autonomously on the device. No victim action is needed.\nS:U - The uninitialized reads, out-of-bounds accesses, and state corruption are all confined to kernel memory and the NFC device state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized/out-of-bounds heap bytes are memcpy'd into `nfc_target.nfcid1`, `sensb_res`, and `sensf_res` by `nci_extract_rf_params_*()` and then exported to userspace by `nfc_genl_send_target()` as netlink attributes, a direct kernel heap information leak; `nci_core_init_rsp_packet_v1()` additionally reads up to ~270 bytes past the payload via an uninitialized `num_supported_rf_interfaces` offset.\nI:H - `nci_core_conn_credits_ntf_packet()` writes `conn_entries[i].conn_id` back into the skb beyond the received payload and adds uninitialized credit values to connection flow control, while uninit values are stored into `ndev->nci_ver`, `max_ctrl_pkt_payload_len`, `supported_rf_interfaces`, and `manufact_specific_info`, corrupting kernel state used by subsequent parsing and transmission decisions.\nA:H - Out-of-bounds reads past the skb buffer and the corrupted length/interface counts driving further parsing can fault or oops the kernel, and the poisoned NCI device state (credit counters, `nci_ver`, packet length limits) leaves the NFC stack in an inconsistent state. Any such memory-safety error in softirq/workqueue context is a full kernel crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "11387b2effbb55f58dc2111ef4b4b896f2756240", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "03fe259649a551d336a7f20919b641ea100e3fff", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "versionType": "git"}, {"status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "lessThan": "d24b03535e5eb82e025219c2f632b485409c898f", "versionType": "git"}], "programFiles": ["net/nfc/nci/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"status": "unaffected", "version": "0", "lessThan": "3.2", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.312", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.85", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.26", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/nfc/nci/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"}, {"url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"}, {"url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"}, {"url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"}, {"url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"}, {"url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"}, {"url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"}, {"url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.85", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.26", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:57.434Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35915", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:41:24.840Z", "dateReserved": "2024-05-17T13:50:33.122Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:35:08.239Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/nci/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "11387b2effbb55f58dc2111ef4b4b896f2756240", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "03fe259649a551d336a7f20919b641ea100e3fff", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}, {"lessThan": "d24b03535e5eb82e025219c2f632b485409c898f", "status": "affected", "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/nci/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.85", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDA8503D-7AD7-4EC3-B31E-F6FD0C2E8403", "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F45A0F3C-C16D-49C4-86D6-D021C3D4B834", "versionEndExcluding": "5.4.274", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "577E212E-7E95-4A71-9B5C-F1D1A3AFFF46", "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "325665BF-2409-49D9-B391-39AD4566FDBD", "versionEndExcluding": "6.1.85", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C520696A-A594-4FFC-A32D-12DA535CE911", "versionEndExcluding": "6.6.26", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nfc: nci: corrigi\u00f3 el valor uninit en nci_dev_up y nci_ntf_packet syzbot inform\u00f3 el siguiente problema de acceso al valor uninit [1][2]: nci_rx_work() analiza y procesa el paquete recibido. Cuando la longitud del payload es cero, cada controlador de tipo de mensaje lee el payload no inicializado y KMSAN detecta este problema. La recepci\u00f3n de un paquete con un payload de tama\u00f1o cero se considera inesperada y, por lo tanto, dichos paquetes deben descartarse silenciosamente. Este parche resolvi\u00f3 este problema verificando el tama\u00f1o del payload antes de llamar a los c\u00f3digos de controlador de cada tipo de mensaje."}], "id": "CVE-2024-35915", "lastModified": "2026-10-15T01:17:52.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35915", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-20T17:12:44.324505Z", "version": "2.0.3"}}]}, "published": "2024-05-19T09:15:11.987", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet", "id": "2281630", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281630"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\nsyzbot reported the following uninit-value access issue [1][2]:\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes."], "name": "CVE-2024-35915", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35915\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35915\nhttps://lore.kernel.org/linux-cve-announce/2024051957-CVE-2024-35915-aead@gregkh/T"], "threat_severity": "Moderate"}

{}