CVE-2024-35915 (GCVE-0-2024-35915)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:35 – Updated: 2026-08-05 11:30
VLAI
Title
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 11387b2effbb55f58dc2111ef4b4b896f2756240 (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 03fe259649a551d336a7f20919b641ea100e3fff (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < ac68d9fa09e410fa3ed20fb721d56aa558695e16 (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7 (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < a946ebee45b09294c8b0b0e77410b763c4d2817a (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 8948e30de81faee87eeee01ef42a1f6008f5a83a (git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < d24b03535e5eb82e025219c2f632b485409c898f (git)
Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:44.324505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:39.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:46.691Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11387b2effbb55f58dc2111ef4b4b896f2756240",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "03fe259649a551d336a7f20919b641ea100e3fff",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "ac68d9fa09e410fa3ed20fb721d56aa558695e16",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "a946ebee45b09294c8b0b0e77410b763c4d2817a",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "8948e30de81faee87eeee01ef42a1f6008f5a83a",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "d24b03535e5eb82e025219c2f632b485409c898f",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - NCI control/notification frames are delivered to `nci_rx_work()` by the NFC controller whose notification stream is driven by an NFC peer/tag in adjacent RF range, and the same parser is fed by the N_NCI tty line discipline and /dev/virtual_nci on the local host. This matches the kernel CNA\u0027s scoring of the directly related NCI packet-validation fixes (CVE-2025-40043, CVE-2026-43291, CVE-2026-63915) as Adjacent.\nAC:L - Triggering only requires that a single NCI frame with a zero payload length field reach the RX queue; the missing check is unconditional, with no race, timing window, or memory-layout precondition. Every dispatch through `nci_rsp_packet()`/`nci_ntf_packet()` then reads past the received data deterministically.\nPR:N - The RF-side path requires no authentication or privileges of any kind \u2014 an NFC peer in range needs no credentials, and the NCI parser runs before any application-level policy. The local fallbacks (N_NCI ldisc via TIOCSETD on a pty) are reachable by an ordinary unprivileged user.\nUI:N - Frames are consumed by the `nci_rx_work` workqueue as soon as they are queued by `nci_recv_frame()`; NFC polling/discovery runs autonomously on the device. No victim action is needed.\nS:U - The uninitialized reads, out-of-bounds accesses, and state corruption are all confined to kernel memory and the NFC device state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized/out-of-bounds heap bytes are memcpy\u0027d into `nfc_target.nfcid1`, `sensb_res`, and `sensf_res` by `nci_extract_rf_params_*()` and then exported to userspace by `nfc_genl_send_target()` as netlink attributes, a direct kernel heap information leak; `nci_core_init_rsp_packet_v1()` additionally reads up to ~270 bytes past the payload via an uninitialized `num_supported_rf_interfaces` offset.\nI:H - `nci_core_conn_credits_ntf_packet()` writes `conn_entries[i].conn_id` back into the skb beyond the received payload and adds uninitialized credit values to connection flow control, while uninit values are stored into `ndev-\u003enci_ver`, `max_ctrl_pkt_payload_len`, `supported_rf_interfaces`, and `manufact_specific_info`, corrupting kernel state used by subsequent parsing and transmission decisions.\nA:H - Out-of-bounds reads past the skb buffer and the corrupted length/interface counts driving further parsing can fault or oops the kernel, and the poisoned NCI device state (credit counters, `nci_ver`, packet length limits) leaves the NFC stack in an inconsistent state. Any such memory-safety error in softirq/workqueue context is a full kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:57.434Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240"
        },
        {
          "url": "https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff"
        },
        {
          "url": "https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16"
        },
        {
          "url": "https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f"
        }
      ],
      "title": "nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35915",
    "datePublished": "2024-05-19T08:35:08.239Z",
    "dateReserved": "2024-05-17T13:50:33.122Z",
    "dateUpdated": "2026-08-05T11:30:57.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35915",
      "date": "2026-08-05",
      "epss": "0.0032",
      "percentile": "0.24364"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35915\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:11.987\",\"lastModified\":\"2026-06-17T07:35:42.810\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\\n\\nsyzbot reported the following uninit-value access issue [1][2]:\\n\\nnci_rx_work() parses and processes received packet. When the payload\\nlength is zero, each message type handler reads uninitialized payload\\nand KMSAN detects this issue. The receipt of a packet with a zero-size\\npayload is considered unexpected, and therefore, such packets should be\\nsilently discarded.\\n\\nThis patch resolved this issue by checking payload size before calling\\neach message type handler codes.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nfc: nci: corrigi\u00f3 el valor uninit en nci_dev_up y nci_ntf_packet syzbot inform\u00f3 el siguiente problema de acceso al valor uninit [1][2]: nci_rx_work() analiza y procesa el paquete recibido. Cuando la longitud del payload es cero, cada controlador de tipo de mensaje lee el payload no inicializado y KMSAN detecta este problema. La recepci\u00f3n de un paquete con un payload de tama\u00f1o cero se considera inesperada y, por lo tanto, dichos paquetes deben descartarse silenciosamente. Este parche resolvi\u00f3 este problema verificando el tama\u00f1o del payload antes de llamar a los c\u00f3digos de controlador de cada tipo de mensaje.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/nfc/nci/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"11387b2effbb55f58dc2111ef4b4b896f2756240\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"03fe259649a551d336a7f20919b641ea100e3fff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"ac68d9fa09e410fa3ed20fb721d56aa558695e16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"a946ebee45b09294c8b0b0e77410b763c4d2817a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"8948e30de81faee87eeee01ef42a1f6008f5a83a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a2968aaf50c7a22fced77a5e24aa636281efca8\",\"lessThan\":\"d24b03535e5eb82e025219c2f632b485409c898f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/nfc/nci/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T17:12:44.324505Z\",\"id\":\"CVE-2024-35915\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"BDA8503D-7AD7-4EC3-B31E-F6FD0C2E8403\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"325665BF-2409-49D9-B391-39AD4566FDBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:03:01+00:00",
      "cve": "CVE-2024-35915",
      "id": "CVE-2024-35915",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35915.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.232Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:52:46.691Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35915\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T17:12:44.324505Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.041Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - NCI control/notification frames are delivered to `nci_rx_work()` by the NFC controller whose notification stream is driven by an NFC peer/tag in adjacent RF range, and the same parser is fed by the N_NCI tty line discipline and /dev/virtual_nci on the local host. This matches the kernel CNA\u0027s scoring of the directly related NCI packet-validation fixes (CVE-2025-40043, CVE-2026-43291, CVE-2026-63915) as Adjacent.\\nAC:L - Triggering only requires that a single NCI frame with a zero payload length field reach the RX queue; the missing check is unconditional, with no race, timing window, or memory-layout precondition. Every dispatch through `nci_rsp_packet()`/`nci_ntf_packet()` then reads past the received data deterministically.\\nPR:N - The RF-side path requires no authentication or privileges of any kind \\u2014 an NFC peer in range needs no credentials, and the NCI parser runs before any application-level policy. The local fallbacks (N_NCI ldisc via TIOCSETD on a pty) are reachable by an ordinary unprivileged user.\\nUI:N - Frames are consumed by the `nci_rx_work` workqueue as soon as they are queued by `nci_recv_frame()`; NFC polling/discovery runs autonomously on the device. No victim action is needed.\\nS:U - The uninitialized reads, out-of-bounds accesses, and state corruption are all confined to kernel memory and the NFC device state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Uninitialized/out-of-bounds heap bytes are memcpy\u0027d into `nfc_target.nfcid1`, `sensb_res`, and `sensf_res` by `nci_extract_rf_params_*()` and then exported to userspace by `nfc_genl_send_target()` as netlink attributes, a direct kernel heap information leak; `nci_core_init_rsp_packet_v1()` additionally reads up to ~270 bytes past the payload via an uninitialized `num_supported_rf_interfaces` offset.\\nI:H - `nci_core_conn_credits_ntf_packet()` writes `conn_entries[i].conn_id` back into the skb beyond the received payload and adds uninitialized credit values to connection flow control, while uninit values are stored into `ndev-\u003enci_ver`, `max_ctrl_pkt_payload_len`, `supported_rf_interfaces`, and `manufact_specific_info`, corrupting kernel state used by subsequent parsing and transmission decisions.\\nA:H - Out-of-bounds reads past the skb buffer and the corrupted length/interface counts driving further parsing can fault or oops the kernel, and the poisoned NCI device state (credit counters, `nci_ver`, packet length limits) leaves the NFC stack in an inconsistent state. Any such memory-safety error in softirq/workqueue context is a full kernel crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"11387b2effbb55f58dc2111ef4b4b896f2756240\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"03fe259649a551d336a7f20919b641ea100e3fff\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"ac68d9fa09e410fa3ed20fb721d56aa558695e16\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"a946ebee45b09294c8b0b0e77410b763c4d2817a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"8948e30de81faee87eeee01ef42a1f6008f5a83a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"d24b03535e5eb82e025219c2f632b485409c898f\", \"versionType\": \"git\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11387b2effbb55f58dc2111ef4b4b896f2756240\"}, {\"url\": \"https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff\"}, {\"url\": \"https://git.kernel.org/stable/c/755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c\"}, {\"url\": \"https://git.kernel.org/stable/c/ac68d9fa09e410fa3ed20fb721d56aa558695e16\"}, {\"url\": \"https://git.kernel.org/stable/c/b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7\"}, {\"url\": \"https://git.kernel.org/stable/c/a946ebee45b09294c8b0b0e77410b763c4d2817a\"}, {\"url\": \"https://git.kernel.org/stable/c/8948e30de81faee87eeee01ef42a1f6008f5a83a\"}, {\"url\": \"https://git.kernel.org/stable/c/d24b03535e5eb82e025219c2f632b485409c898f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\\n\\nsyzbot reported the following uninit-value access issue [1][2]:\\n\\nnci_rx_work() parses and processes received packet. When the payload\\nlength is zero, each message type handler reads uninitialized payload\\nand KMSAN detects this issue. The receipt of a packet with a zero-size\\npayload is considered unexpected, and therefore, such packets should be\\nsilently discarded.\\n\\nThis patch resolved this issue by checking payload size before calling\\neach message type handler codes.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:57.434Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35915\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:57.434Z\", \"dateReserved\": \"2024-05-17T13:50:33.122Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:35:08.239Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.