Linux Kernel NFC HCI Out-of-Bounds Read Vulnerability

A vulnerability in the Linux kernel's NFC HCI implementation allows for an out-of-bounds heap read. This issue arises in both the 'nfc_hci_recv_from_llc()' and 'nci_hci_data_received_cb()' functions, where 'packet->header' is read from 'skb->data' without verifying that the buffer contains at least one byte. A malicious NFC peer can send a 0-byte HCP frame that bypasses the SHDLC layer, leading to the out-of-bounds read. Additionally, if the 0-byte frame is sent as a non-final fragment, it causes the reassembly loop to underflow 'msg_len', resulting in a panic when the reassembled skb is processed.

Impact

Exploitation of this vulnerability causes an out-of-bounds read from the heap, which can lead to memory corruption or information disclosure.

Reproduction

To reproduce this vulnerability, send a 0-byte HCP frame over NFC that passes through the SHDLC layer. This can be done by queuing the frame as a non-final fragment, which will trigger the reassembly loop to underflow the message length, causing a panic when the reassembled skb is written.

Remediation

The vulnerability has been fixed by adding a check to ensure the skb buffer is large enough before accessing the HCP header. This fix is available in the Linux kernel stable tree.