CVE-2024-38381 (GCVE-0-2024-38381)
Vulnerability from cvelistv5
Published
2024-06-21 10:18
Modified
2026-08-05 11:32
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.
References
Impacted products
Vendor Product Version
Linux Linux Version: 11387b2effbb55f58dc2111ef4b4b896f2756240
Version: 03fe259649a551d336a7f20919b641ea100e3fff
Version: 755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c
Version: ac68d9fa09e410fa3ed20fb721d56aa558695e16
Version: b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7
Version: a946ebee45b09294c8b0b0e77410b763c4d2817a
Version: d24b03535e5eb82e025219c2f632b485409c898f
Version: d24b03535e5eb82e025219c2f632b485409c898f
Version: 8948e30de81faee87eeee01ef42a1f6008f5a83a
Version: 4.19.312   ≤
Version: 5.4.274   ≤
Version: 5.10.215   ≤
Version: 5.15.154   ≤
Version: 6.1.85   ≤
Version: 6.6.26   ≤
Version: 6.8.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:21:21.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:09:25.051432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:45.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:54:33.657Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "406cfac9debd4a6d3dc5d9258ee086372a8c08b6",
              "status": "affected",
              "version": "11387b2effbb55f58dc2111ef4b4b896f2756240",
              "versionType": "git"
            },
            {
              "lessThan": "485ded868ed62ceb2acb3a459d7843fd71472619",
              "status": "affected",
              "version": "03fe259649a551d336a7f20919b641ea100e3fff",
              "versionType": "git"
            },
            {
              "lessThan": "f80b786ab0550d0020191a59077b2c7e069db2d1",
              "status": "affected",
              "version": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c",
              "versionType": "git"
            },
            {
              "lessThan": "ad4d196d2008c7f413167f0a693feb4f0439d7fe",
              "status": "affected",
              "version": "ac68d9fa09e410fa3ed20fb721d56aa558695e16",
              "versionType": "git"
            },
            {
              "lessThan": "e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3",
              "status": "affected",
              "version": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7",
              "versionType": "git"
            },
            {
              "lessThan": "e53a7f8afcbd2886f2a94c5d56757328109730ea",
              "status": "affected",
              "version": "a946ebee45b09294c8b0b0e77410b763c4d2817a",
              "versionType": "git"
            },
            {
              "lessThan": "017ff397624930fd7ac7f1761f3c9d6a7100f68c",
              "status": "affected",
              "version": "d24b03535e5eb82e025219c2f632b485409c898f",
              "versionType": "git"
            },
            {
              "lessThan": "e4a87abf588536d1cdfb128595e6e680af5cf3ed",
              "status": "affected",
              "version": "d24b03535e5eb82e025219c2f632b485409c898f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8948e30de81faee87eeee01ef42a1f6008f5a83a",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.316",
              "status": "affected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.278",
              "status": "affected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.219",
              "status": "affected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.161",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.93",
              "status": "affected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.33",
              "status": "affected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.19.312",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "5.4.274",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.10.215",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "6.1.85",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_rx_work\n\nsyzbot reported the following uninit-value access issue [1]\n\nnci_rx_work() parses received packet from ndev-\u003erx_q. It should be\nvalidated header size, payload size and total packet size before\nprocessing the packet. If an invalid packet is detected, it should be\nsilently discarded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The NCI RX path parses frames delivered by the NFC controller, which are driven by the NFC air interface, so a rogue tag/peer or NFCC within NFC radio range reaches this code. This matches the kernel CNA\u0027s established AV:A treatment of NCI packet-parsing bugs, including the direct follow-ups to this very `nci_valid_size()` helper (CVE-2025-40043, CVE-2026-43291).\nAC:L - Triggering only requires delivering a truncated NCI frame (`skb-\u003elen \u003c 3`, or `skb-\u003elen \u003c 3 + plen`); there is no race, no timing window, and no memory-layout precondition the attacker cannot influence. The condition is deterministic and reproducible on every frame.\nPR:N - `nci_recv_frame()` queues frames and `nci_rx_work()` parses them with no capability, credential, or authentication check anywhere on the path \u2014 NFC peering is entirely unauthenticated. No privileges of any kind are needed.\nUI:N - Parsing happens asynchronously in the `rx_wq` workqueue as soon as a frame arrives; no victim action is required beyond the NFC stack being active in its normal discovery/polling state.\nS:U - The out-of-bounds reads, the resulting state corruption, and the downstream heap overflow all occur within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Handlers read up to ~260 bytes past a small heap object (e.g. `rsp_2 = skb-\u003edata + 6 + num_supported_rf_interfaces` with an uncontrolled 0\u2013255 offset), and those bytes are copied into `ndev-\u003etargets[]` and `ndev-\u003eremote_gb`, which are exported to userspace via NFC netlink `NFC_EVENT_TARGETS_FOUND` and LLCP \u2014 a direct kernel-memory disclosure primitive.\nI:H - Out-of-bounds bytes are written into kernel state (`conn_info-\u003emax_pkt_payload_len`, `ndev-\u003emax_ctrl_pkt_payload_len`, `credits_cnt`), and a garbage `max_pkt_payload_len` makes `len = max_pkt_payload_len - skb-\u003elen - 1` in `nci_hci_send_data()` underflow, driving `skb_put_data()` past the skb tail for a heap out-of-bounds write.\nA:H - The unbounded reads (`skb-\u003edata[-1]` on a zero-length skb, and a 0\u2013255-byte uncontrolled pointer offset) fault or trip KASAN, and the derived length underflow corrupts the heap, producing an oops or panic that is repeatable on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:33.123Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed"
        }
      ],
      "title": "nfc: nci: Fix uninit-value in nci_rx_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38381",
    "datePublished": "2024-06-21T10:18:12.302Z",
    "dateReserved": "2024-06-21T10:12:11.547Z",
    "dateUpdated": "2026-08-05T11:32:33.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:21:21.599Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-613116.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:54:33.657Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38381\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:09:25.051432Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.683Z\"}}], \"cna\": {\"title\": \"nfc: nci: Fix uninit-value in nci_rx_work\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"11387b2effbb55f58dc2111ef4b4b896f2756240\", \"lessThan\": \"406cfac9debd4a6d3dc5d9258ee086372a8c08b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"03fe259649a551d336a7f20919b641ea100e3fff\", \"lessThan\": \"485ded868ed62ceb2acb3a459d7843fd71472619\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\", \"lessThan\": \"f80b786ab0550d0020191a59077b2c7e069db2d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ac68d9fa09e410fa3ed20fb721d56aa558695e16\", \"lessThan\": \"ad4d196d2008c7f413167f0a693feb4f0439d7fe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\", \"lessThan\": \"e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a946ebee45b09294c8b0b0e77410b763c4d2817a\", \"lessThan\": \"e53a7f8afcbd2886f2a94c5d56757328109730ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d24b03535e5eb82e025219c2f632b485409c898f\", \"lessThan\": \"017ff397624930fd7ac7f1761f3c9d6a7100f68c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d24b03535e5eb82e025219c2f632b485409c898f\", \"lessThan\": \"e4a87abf588536d1cdfb128595e6e680af5cf3ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8948e30de81faee87eeee01ef42a1f6008f5a83a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.312\", \"lessThan\": \"4.19.316\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.274\", \"lessThan\": \"5.4.278\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.215\", \"lessThan\": \"5.10.219\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.154\", \"lessThan\": \"5.15.161\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.85\", \"lessThan\": \"6.1.93\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.26\", \"lessThan\": \"6.6.33\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.8.5\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/406cfac9debd4a6d3dc5d9258ee086372a8c08b6\"}, {\"url\": \"https://git.kernel.org/stable/c/485ded868ed62ceb2acb3a459d7843fd71472619\"}, {\"url\": \"https://git.kernel.org/stable/c/f80b786ab0550d0020191a59077b2c7e069db2d1\"}, {\"url\": \"https://git.kernel.org/stable/c/ad4d196d2008c7f413167f0a693feb4f0439d7fe\"}, {\"url\": \"https://git.kernel.org/stable/c/e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3\"}, {\"url\": \"https://git.kernel.org/stable/c/e53a7f8afcbd2886f2a94c5d56757328109730ea\"}, {\"url\": \"https://git.kernel.org/stable/c/017ff397624930fd7ac7f1761f3c9d6a7100f68c\"}, {\"url\": \"https://git.kernel.org/stable/c/e4a87abf588536d1cdfb128595e6e680af5cf3ed\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfc: nci: Fix uninit-value in nci_rx_work\\n\\nsyzbot reported the following uninit-value access issue [1]\\n\\nnci_rx_work() parses received packet from ndev-\u003erx_q. It should be\\nvalidated header size, payload size and total packet size before\\nprocessing the packet. If an invalid packet is detected, it should be\\nsilently discarded.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"4.19.312\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"5.4.274\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"5.10.215\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.15.154\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"6.1.85\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"6.6.26\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.4\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:48:15.946Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38381\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:48:15.946Z\", \"dateReserved\": \"2024-06-21T10:12:11.547Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-21T10:18:12.302Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.