CVE-2024-38381

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-38381", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-21T10:12:11.547Z", "datePublished": "2024-06-21T10:18:12.302Z", "dateUpdated": "2026-10-15T00:43:18.545Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:33.123Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_rx_work\n\nsyzbot reported the following uninit-value access issue [1]\n\nnci_rx_work() parses received packet from ndev->rx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The NCI RX path parses frames delivered by the NFC controller, which are driven by the NFC air interface, so a rogue tag/peer or NFCC within NFC radio range reaches this code. This matches the kernel CNA's established AV:A treatment of NCI packet-parsing bugs, including the direct follow-ups to this very `nci_valid_size()` helper (CVE-2025-40043, CVE-2026-43291).\nAC:L - Triggering only requires delivering a truncated NCI frame (`skb->len < 3`, or `skb->len < 3 + plen`); there is no race, no timing window, and no memory-layout precondition the attacker cannot influence. The condition is deterministic and reproducible on every frame.\nPR:N - `nci_recv_frame()` queues frames and `nci_rx_work()` parses them with no capability, credential, or authentication check anywhere on the path \u2014 NFC peering is entirely unauthenticated. No privileges of any kind are needed.\nUI:N - Parsing happens asynchronously in the `rx_wq` workqueue as soon as a frame arrives; no victim action is required beyond the NFC stack being active in its normal discovery/polling state.\nS:U - The out-of-bounds reads, the resulting state corruption, and the downstream heap overflow all occur within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Handlers read up to ~260 bytes past a small heap object (e.g. `rsp_2 = skb->data + 6 + num_supported_rf_interfaces` with an uncontrolled 0\u2013255 offset), and those bytes are copied into `ndev->targets[]` and `ndev->remote_gb`, which are exported to userspace via NFC netlink `NFC_EVENT_TARGETS_FOUND` and LLCP \u2014 a direct kernel-memory disclosure primitive.\nI:H - Out-of-bounds bytes are written into kernel state (`conn_info->max_pkt_payload_len`, `ndev->max_ctrl_pkt_payload_len`, `credits_cnt`), and a garbage `max_pkt_payload_len` makes `len = max_pkt_payload_len - skb->len - 1` in `nci_hci_send_data()` underflow, driving `skb_put_data()` past the skb tail for a heap out-of-bounds write.\nA:H - The unbounded reads (`skb->data[-1]` on a zero-length skb, and a 0\u2013255-byte uncontrolled pointer offset) fault or trip KASAN, and the derived length underflow corrupts the heap, producing an oops or panic that is repeatable on demand."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/nci/core.c"], "versions": [{"version": "11387b2effbb55f58dc2111ef4b4b896f2756240", "lessThan": "406cfac9debd4a6d3dc5d9258ee086372a8c08b6", "status": "affected", "versionType": "git"}, {"version": "03fe259649a551d336a7f20919b641ea100e3fff", "lessThan": "485ded868ed62ceb2acb3a459d7843fd71472619", "status": "affected", "versionType": "git"}, {"version": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "lessThan": "f80b786ab0550d0020191a59077b2c7e069db2d1", "status": "affected", "versionType": "git"}, {"version": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "lessThan": "ad4d196d2008c7f413167f0a693feb4f0439d7fe", "status": "affected", "versionType": "git"}, {"version": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "lessThan": "e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3", "status": "affected", "versionType": "git"}, {"version": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "lessThan": "e53a7f8afcbd2886f2a94c5d56757328109730ea", "status": "affected", "versionType": "git"}, {"version": "d24b03535e5eb82e025219c2f632b485409c898f", "lessThan": "017ff397624930fd7ac7f1761f3c9d6a7100f68c", "status": "affected", "versionType": "git"}, {"version": "d24b03535e5eb82e025219c2f632b485409c898f", "lessThan": "e4a87abf588536d1cdfb128595e6e680af5cf3ed", "status": "affected", "versionType": "git"}, {"version": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "status": "affected", "versionType": "git"}, {"version": "4.19.312", "lessThan": "4.19.316", "status": "affected", "versionType": "semver"}, {"version": "5.4.274", "lessThan": "5.4.278", "status": "affected", "versionType": "semver"}, {"version": "5.10.215", "lessThan": "5.10.219", "status": "affected", "versionType": "semver"}, {"version": "5.15.154", "lessThan": "5.15.161", "status": "affected", "versionType": "semver"}, {"version": "6.1.85", "lessThan": "6.1.93", "status": "affected", "versionType": "semver"}, {"version": "6.6.26", "lessThan": "6.6.33", "status": "affected", "versionType": "semver"}, {"version": "6.8.5", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/nci/core.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.316", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.312", "versionEndExcluding": "4.19.316"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.274", "versionEndExcluding": "5.4.278"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.215", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.154", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.85", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.26", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"}, {"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"}, {"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"}, {"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"}, {"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"}, {"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"}, {"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"}, {"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"}], "title": "nfc: nci: Fix uninit-value in nci_rx_work", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:21:21.599Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38381", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:09:25.051432Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:45.388Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:18.545Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:21:21.599Z"}}, {"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:18.545Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38381", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:09:25.051432Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:25.683Z"}}], "cna": {"title": "nfc: nci: Fix uninit-value in nci_rx_work", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The NCI RX path parses frames delivered by the NFC controller, which are driven by the NFC air interface, so a rogue tag/peer or NFCC within NFC radio range reaches this code. This matches the kernel CNA's established AV:A treatment of NCI packet-parsing bugs, including the direct follow-ups to this very `nci_valid_size()` helper (CVE-2025-40043, CVE-2026-43291).\nAC:L - Triggering only requires delivering a truncated NCI frame (`skb->len < 3`, or `skb->len < 3 + plen`); there is no race, no timing window, and no memory-layout precondition the attacker cannot influence. The condition is deterministic and reproducible on every frame.\nPR:N - `nci_recv_frame()` queues frames and `nci_rx_work()` parses them with no capability, credential, or authentication check anywhere on the path \u2014 NFC peering is entirely unauthenticated. No privileges of any kind are needed.\nUI:N - Parsing happens asynchronously in the `rx_wq` workqueue as soon as a frame arrives; no victim action is required beyond the NFC stack being active in its normal discovery/polling state.\nS:U - The out-of-bounds reads, the resulting state corruption, and the downstream heap overflow all occur within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Handlers read up to ~260 bytes past a small heap object (e.g. `rsp_2 = skb->data + 6 + num_supported_rf_interfaces` with an uncontrolled 0\u2013255 offset), and those bytes are copied into `ndev->targets[]` and `ndev->remote_gb`, which are exported to userspace via NFC netlink `NFC_EVENT_TARGETS_FOUND` and LLCP \u2014 a direct kernel-memory disclosure primitive.\nI:H - Out-of-bounds bytes are written into kernel state (`conn_info->max_pkt_payload_len`, `ndev->max_ctrl_pkt_payload_len`, `credits_cnt`), and a garbage `max_pkt_payload_len` makes `len = max_pkt_payload_len - skb->len - 1` in `nci_hci_send_data()` underflow, driving `skb_put_data()` past the skb tail for a heap out-of-bounds write.\nA:H - The unbounded reads (`skb->data[-1]` on a zero-length skb, and a 0\u2013255-byte uncontrolled pointer offset) fault or trip KASAN, and the derived length underflow corrupts the heap, producing an oops or panic that is repeatable on demand."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "11387b2effbb55f58dc2111ef4b4b896f2756240", "lessThan": "406cfac9debd4a6d3dc5d9258ee086372a8c08b6", "versionType": "git"}, {"status": "affected", "version": "03fe259649a551d336a7f20919b641ea100e3fff", "lessThan": "485ded868ed62ceb2acb3a459d7843fd71472619", "versionType": "git"}, {"status": "affected", "version": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "lessThan": "f80b786ab0550d0020191a59077b2c7e069db2d1", "versionType": "git"}, {"status": "affected", "version": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "lessThan": "ad4d196d2008c7f413167f0a693feb4f0439d7fe", "versionType": "git"}, {"status": "affected", "version": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "lessThan": "e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3", "versionType": "git"}, {"status": "affected", "version": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "lessThan": "e53a7f8afcbd2886f2a94c5d56757328109730ea", "versionType": "git"}, {"status": "affected", "version": "d24b03535e5eb82e025219c2f632b485409c898f", "lessThan": "017ff397624930fd7ac7f1761f3c9d6a7100f68c", "versionType": "git"}, {"status": "affected", "version": "d24b03535e5eb82e025219c2f632b485409c898f", "lessThan": "e4a87abf588536d1cdfb128595e6e680af5cf3ed", "versionType": "git"}, {"status": "affected", "version": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "versionType": "git"}, {"status": "affected", "version": "4.19.312", "lessThan": "4.19.316", "versionType": "semver"}, {"status": "affected", "version": "5.4.274", "lessThan": "5.4.278", "versionType": "semver"}, {"status": "affected", "version": "5.10.215", "lessThan": "5.10.219", "versionType": "semver"}, {"status": "affected", "version": "5.15.154", "lessThan": "5.15.161", "versionType": "semver"}, {"status": "affected", "version": "6.1.85", "lessThan": "6.1.93", "versionType": "semver"}, {"status": "affected", "version": "6.6.26", "lessThan": "6.6.33", "versionType": "semver"}, {"status": "affected", "version": "6.8.5", "lessThan": "6.9", "versionType": "semver"}], "programFiles": ["net/nfc/nci/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.316", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.278", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/nfc/nci/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"}, {"url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"}, {"url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"}, {"url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"}, {"url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"}, {"url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"}, {"url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"}, {"url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_rx_work\n\nsyzbot reported the following uninit-value access issue [1]\n\nnci_rx_work() parses received packet from ndev->rx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.316", "versionStartIncluding": "4.19.312"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.278", "versionStartIncluding": "5.4.274"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.10.215"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.15.154"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.93", "versionStartIncluding": "6.1.85"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6.26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.4", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.8.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:33.123Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38381", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:43:18.545Z", "dateReserved": "2024-06-21T10:12:11.547Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-21T10:18:12.302Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/nci/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "406cfac9debd4a6d3dc5d9258ee086372a8c08b6", "status": "affected", "version": "11387b2effbb55f58dc2111ef4b4b896f2756240", "versionType": "git"}, {"lessThan": "485ded868ed62ceb2acb3a459d7843fd71472619", "status": "affected", "version": "03fe259649a551d336a7f20919b641ea100e3fff", "versionType": "git"}, {"lessThan": "f80b786ab0550d0020191a59077b2c7e069db2d1", "status": "affected", "version": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c", "versionType": "git"}, {"lessThan": "ad4d196d2008c7f413167f0a693feb4f0439d7fe", "status": "affected", "version": "ac68d9fa09e410fa3ed20fb721d56aa558695e16", "versionType": "git"}, {"lessThan": "e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3", "status": "affected", "version": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7", "versionType": "git"}, {"lessThan": "e53a7f8afcbd2886f2a94c5d56757328109730ea", "status": "affected", "version": "a946ebee45b09294c8b0b0e77410b763c4d2817a", "versionType": "git"}, {"lessThan": "017ff397624930fd7ac7f1761f3c9d6a7100f68c", "status": "affected", "version": "d24b03535e5eb82e025219c2f632b485409c898f", "versionType": "git"}, {"lessThan": "e4a87abf588536d1cdfb128595e6e680af5cf3ed", "status": "affected", "version": "d24b03535e5eb82e025219c2f632b485409c898f", "versionType": "git"}, {"status": "affected", "version": "8948e30de81faee87eeee01ef42a1f6008f5a83a", "versionType": "git"}, {"lessThan": "4.19.316", "status": "affected", "version": "4.19.312", "versionType": "semver"}, {"lessThan": "5.4.278", "status": "affected", "version": "5.4.274", "versionType": "semver"}, {"lessThan": "5.10.219", "status": "affected", "version": "5.10.215", "versionType": "semver"}, {"lessThan": "5.15.161", "status": "affected", "version": "5.15.154", "versionType": "semver"}, {"lessThan": "6.1.93", "status": "affected", "version": "6.1.85", "versionType": "semver"}, {"lessThan": "6.6.33", "status": "affected", "version": "6.6.26", "versionType": "semver"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/nci/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.316", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.278", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V3.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "vendor": "Siemens", "versions": [{"lessThan": "V3.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D26B120-31EC-4900-BA59-4C7E3305CA07", "versionEndExcluding": "4.19.316", "versionStartIncluding": "4.19.312", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EBA12E3E-3226-4BFE-80FA-CD00384BB4A8", "versionEndExcluding": "5.4.278", "versionStartIncluding": "5.4.274", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EFD9B2DB-0408-4028-A90E-3F67DBA2BE2E", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.10.215", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3873B618-2078-4018-8EE8-F39FEC6600A3", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.15.154", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14DD8BC5-AB23-4D66-9B55-49AAEC715BE0", "versionEndExcluding": "6.1.93", "versionStartIncluding": "6.1.85", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9039270-312D-4ADA-865A-BF010D3A4230", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.6.26", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEF6A8C7-1C2F-4ED1-B8B2-57BEC82588F2", "versionEndExcluding": "6.9.4", "versionStartIncluding": "6.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_rx_work\n\nsyzbot reported the following uninit-value access issue [1]\n\nnci_rx_work() parses received packet from ndev->rx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nfc: nci: corrigi\u00f3 el valor uninit en nci_rx_work syzbot inform\u00f3 el siguiente problema de acceso al valor uninit [1] nci_rx_work() analiza el paquete recibido de ndev-&gt;rx_q. Se debe validar el tama\u00f1o del encabezado, el tama\u00f1o del payload y el tama\u00f1o total del paquete antes de procesar el paquete. Si se detecta un paquete no v\u00e1lido, se debe descartar silenciosamente."}], "id": "CVE-2024-38381", "lastModified": "2026-10-15T01:18:27.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38381", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:09:25.051432Z", "version": "2.0.3"}}]}, "published": "2024-06-21T11:15:10.757", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nfc: nci: Fix uninit-value in nci_rx_work", "id": "2293683", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293683"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: nci: Fix uninit-value in nci_rx_work\nsyzbot reported the following uninit-value access issue [1]\nnci_rx_work() parses received packet from ndev->rx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded.", "A vulnerability was found in the NCI component in the Linux kernel's NFC subsystem. This issue involves an uninitialized value in the `nci_rx_work` function, which could lead to unintended behavior or potential security risks."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-38381", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38381\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38381\nhttps://lore.kernel.org/linux-cve-announce/2024062137-CVE-2024-38381-07fb@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{}