VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 19, 2024· Updated May 12, 2026

CVE-2024-35915

CVE-2024-35915

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet

syzbot reported the following uninit-value access issue [1][2]:

nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.

This patch resolved this issue by checking payload size before calling each message type handler codes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A flaw in the Linux kernel's NFC NCI subsystem allows uninitialized memory access when processing packets with zero payload length, potentially leading to information disclosure.

Vulnerability

Overview

CVE-2024-35915 is an uninitialized value (uninit-value) vulnerability in the Linux kernel's NFC (Near Field Communication) NCI (NFC Controller Interface) subsystem. The issue arises in the nci_dev_up and nci_ntf_packet functions, which are invoked when the kernel processes received NFC packets. When a packet with a payload length of zero is received, the message type handler reads uninitialized memory because the payload is not properly validated before use [1].

Exploitation

Vectors

An attacker on the same NFC network or with physical proximity could send a specially crafted NFC packet with zero payload length. The packet is received by the kernel's NCI subsystem, which then dispatches it to the appropriate handler without checking if the payload size is zero. This missing validation causes the handler to read uninitialized kernel memory, which could be leaked or used in further processing. No special privileges are required beyond the ability to send NFC packets to the target device [2].

Potential

Impact

Successful exploitation may lead to the disclosure of sensitive kernel memory contents or other unintended behavior. The uninitialized memory could contain previously stored data, potentially exposing kernel addresses or other secrets. This issue has been assigned a CVSS v3 score of 5.5 (Medium) and is considered a medium-severity information disclosure vulnerability.

Mitigation

Status

The vulnerability was patched in the Linux kernel by adding a payload size check before invoking message type handlers. The fix ensures that packets with zero-length payloads are silently discarded [2][3][4]. Users should update to a patched kernel version. The Siemens advisory SSA-265688 lists affected products including SIMATIC S7-1500 TM MFP with GNU/Linux subsystem, and recommends updating to fixed versions [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

119

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.