CVE-2022-50656

Vulnerability

Description

The Linux kernel's NFC (Near Field Communication) pn533 driver fails to properly initialize the nfc_target structure before use. This oversight means that when a target is created, fields such as sensb_res_len can contain uninitialized (garbage) values. The CVE description reports this leads to a slab-out-of-bounds read in nla_put() when called from nfc_genl_send_target() during netlink operations [1].

Exploitation

Method

An attacker with local access to the system could trigger this vulnerability by sending crafted NFC frames via the pn533 driver. The bug was discovered using a modified version of syzkaller, a kernel fuzzer. No authentication is required beyond local access to the NFC interface. The uninitialized data is copied into a netlink message, causing nla_put() to read beyond the intended bounds of the slab allocation [1].

Impact

Successful exploitation results in a slab-out-of-bounds read, which can leak sensitive kernel memory contents to the attacker. This could expose information useful for further exploitation, such as kernel pointers or data structures. The vulnerability also causes a kernel crash (KASAN splat) leading to a denial of service [1].

Mitigation

The fix involves clearing the nfc_target structure with memset() before use, ensuring all fields are zero-initialized. This patch has been applied to stable kernel trees [2][3][4]. Users should update to a patched kernel version. No workarounds are available; updating is the only recommended action.