CVE-2022-48967 (GCVE-0-2022-48967)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:05 – Updated: 2026-08-05 08:53
VLAI
Title
NFC: nci: Bounds check struct nfc_target arrays
Summary
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:19 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < 6b37f0dc0638d13a006f2f24d2f6ca61e83bc714 (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < dbdcfb9f6748218a149f62468d6297ce3f014e9c (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < cff35329070b96b4484d23f9f48a5ca2c947e750 (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < 6778434706940b8fad7ef35f410d2b9929f256d2 (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < 27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9 (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < 908b2da426fe9c3ce74cf541ba40e7a4251db191 (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < f41547546db9af99da2c34e3368664d7a79cefae (git)
Affected: 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 , < e329e71013c9b5a4535b099208493c7826ee4a64 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 4.9.336 , ≤ 4.9.* (semver)
Unaffected: 4.14.302 , ≤ 4.14.* (semver)
Unaffected: 4.19.269 , ≤ 4.19.* (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:19:37.596608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:38.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/ntf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b37f0dc0638d13a006f2f24d2f6ca61e83bc714",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "dbdcfb9f6748218a149f62468d6297ce3f014e9c",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "cff35329070b96b4484d23f9f48a5ca2c947e750",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "6778434706940b8fad7ef35f410d2b9929f256d2",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "908b2da426fe9c3ce74cf541ba40e7a4251db191",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "f41547546db9af99da2c34e3368664d7a79cefae",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            },
            {
              "lessThan": "e329e71013c9b5a4535b099208493c7826ee4a64",
              "status": "affected",
              "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/ntf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.336",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.336",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.302",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.269",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target-\u003esensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The overflow is reached while parsing NCI RF_DISCOVER_NTF frames delivered by the NFC controller from an NFC peer/tag in RF range (nci_recv_frame \u2192 nci_rx_work \u2192 nci_ntf_packet \u2192 nci_rf_discover_ntf_packet \u2192 nci_add_new_protocol), matching established AV:A scoring for NCI bugs (CVE-2024-35915, CVE-2024-38381, CVE-2023-52502).\nAC:L - A single crafted Discover NTF (e.g. NFC-F with rf_tech_specific_params_len=0 leaving sensf_res_len uninitialized, or any path that supplies a length \u003e array size) deterministically drives the unbounded memcpy; ~93% of random u8 lengths exceed the 18-byte field, with no race or attacker-uncontrollable precondition.\nPR:N - NFC discovery notifications are processed with no authentication from an adjacent peer while the platform NFC stack is polling, and the same parser is reachable via N_NCI without credentials; no attacker-held capability is required on the severe path.\nUI:N - Frames are handled asynchronously on nci_rx_work during normal autonomous NFC poll/discovery; no victim action such as mounting a filesystem or confirming a prompt is required.\nS:U - The out-of-bounds write corrupts kernel heap state inside struct nci_dev (targets[] and adjacent fields) within the host OS security authority, with no VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - The oversized memcpy both reads past the 18-byte source on the stack and writes past target-\u003esensf_res into adjacent nfc_target/nci_dev heap memory, and the inflated sensf_res_len is later exported via nfc_genl_send_target netlink attributes\u2014memory corruption with a disclosure path, scored Confidentiality High.\nI:H - This is a genuine heap out-of-bounds write of up to 255 bytes into ndev-\u003etargets[] (and past the array for late indices into n_targets and following nci_dev fields), enabling corruption of kernel NFC state and control-flow primitives per OOB-write guidance.\nA:H - Syzkaller already hit a fortify WARNING that panics under panic_on_warn, and an unbounded heap write in workqueue context reliably produces kernel oops/panic even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:11.975Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83bc714"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbdcfb9f6748218a149f62468d6297ce3f014e9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cff35329070b96b4484d23f9f48a5ca2c947e750"
        },
        {
          "url": "https://git.kernel.org/stable/c/6778434706940b8fad7ef35f410d2b9929f256d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/908b2da426fe9c3ce74cf541ba40e7a4251db191"
        },
        {
          "url": "https://git.kernel.org/stable/c/f41547546db9af99da2c34e3368664d7a79cefae"
        },
        {
          "url": "https://git.kernel.org/stable/c/e329e71013c9b5a4535b099208493c7826ee4a64"
        }
      ],
      "title": "NFC: nci: Bounds check struct nfc_target arrays",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48967",
    "datePublished": "2024-10-21T20:05:49.740Z",
    "dateReserved": "2024-08-22T01:27:53.628Z",
    "dateUpdated": "2026-08-05T08:53:11.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48967",
      "date": "2026-09-28",
      "epss": "0.00343",
      "percentile": "0.25226"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3BEFC972-1632-47E4-8880-E7069D4615A6",
                  "versionEndExcluding": "4.9.336",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FB3E1F82-01A3-456E-9C83-D567B9A75815",
                  "versionEndExcluding": "4.14.302",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1185B8E3-712E-4BFB-BD01-78D47F7EF1F2",
                  "versionEndExcluding": "4.19.269",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8C752145-904B-474A-A7F2-E9F29353B0FE",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7318B597-DFFD-4BBC-A947-539D6E30D82A",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "90897BD1-104D-4CFF-94F5-29F9041217FB",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "389392A7-81C4-4C26-884B-8C7CF0F53DA4",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                  "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*",
                  "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target-\u003esensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFC: nci: Comprobaci\u00f3n de los l\u00edmites de matrices struct nfc_target Mientras se ejecutaba bajo CONFIG_FORTIFY_SOURCE=y, syzkaller inform\u00f3: memcpy: se detect\u00f3 una escritura que abarcaba campos (tama\u00f1o 129) de un solo campo \"target-\u0026gt;sensf_res\" en net/nfc/nci/ntf.c:260 (tama\u00f1o 18) Esto parece ser una falta leg\u00edtima de comprobaci\u00f3n de los l\u00edmites en nci_add_new_protocol(). Agregue las comprobaciones faltantes."
        }
      ],
      "id": "CVE-2022-48967",
      "lastModified": "2024-10-25T21:27:46.017",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.2,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T20:15:08.757",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6778434706940b8fad7ef35f410d2b9929f256d2"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83bc714"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/908b2da426fe9c3ce74cf541ba40e7a4251db191"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/cff35329070b96b4484d23f9f48a5ca2c947e750"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/dbdcfb9f6748218a149f62468d6297ce3f014e9c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/e329e71013c9b5a4535b099208493c7826ee4a64"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f41547546db9af99da2c34e3368664d7a79cefae"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-129"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/nci/ntf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6b37f0dc0638d13a006f2f24d2f6ca61e83bc714",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbdcfb9f6748218a149f62468d6297ce3f014e9c",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cff35329070b96b4484d23f9f48a5ca2c947e750",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6778434706940b8fad7ef35f410d2b9929f256d2",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "908b2da426fe9c3ce74cf541ba40e7a4251db191",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f41547546db9af99da2c34e3368664d7a79cefae",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e329e71013c9b5a4535b099208493c7826ee4a64",
                    "status": "affected",
                    "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/nci/ntf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.4"
                  },
                  {
                    "lessThan": "3.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.336",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.302",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.269",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.227",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.159",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3BEFC972-1632-47E4-8880-E7069D4615A6",
                    "versionEndExcluding": "4.9.336",
                    "versionStartIncluding": "3.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FB3E1F82-01A3-456E-9C83-D567B9A75815",
                    "versionEndExcluding": "4.14.302",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1185B8E3-712E-4BFB-BD01-78D47F7EF1F2",
                    "versionEndExcluding": "4.19.269",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8C752145-904B-474A-A7F2-E9F29353B0FE",
                    "versionEndExcluding": "5.4.227",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7318B597-DFFD-4BBC-A947-539D6E30D82A",
                    "versionEndExcluding": "5.10.159",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "90897BD1-104D-4CFF-94F5-29F9041217FB",
                    "versionEndExcluding": "5.15.83",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "389392A7-81C4-4C26-884B-8C7CF0F53DA4",
                    "versionEndExcluding": "6.0.13",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target-\u003esensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFC: nci: Comprobaci\u00f3n de los l\u00edmites de matrices struct nfc_target Mientras se ejecutaba bajo CONFIG_FORTIFY_SOURCE=y, syzkaller inform\u00f3: memcpy: se detect\u00f3 una escritura que abarcaba campos (tama\u00f1o 129) de un solo campo \"target-\u0026gt;sensf_res\" en net/nfc/nci/ntf.c:260 (tama\u00f1o 18) Esto parece ser una falta leg\u00edtima de comprobaci\u00f3n de los l\u00edmites en nci_add_new_protocol(). Agregue las comprobaciones faltantes."
          }
        ],
        "id": "CVE-2022-48967",
        "lastModified": "2026-08-04T10:17:28.910",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48967",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:19:37.596608Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T20:15:08.757",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6778434706940b8fad7ef35f410d2b9929f256d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83bc714"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/908b2da426fe9c3ce74cf541ba40e7a4251db191"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cff35329070b96b4484d23f9f48a5ca2c947e750"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dbdcfb9f6748218a149f62468d6297ce3f014e9c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e329e71013c9b5a4535b099208493c7826ee4a64"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f41547546db9af99da2c34e3368664d7a79cefae"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:17:23+00:00",
      "cve": "CVE-2022-48967",
      "id": "CVE-2022-48967",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFC: nci: Bounds check struct nfc_target arrays",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48967.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:32:04Z",
      "cve": "CVE-2022-48967",
      "id": "CVE-2022-48967",
      "initial_release_date": "2024-10-22T14:23:08Z",
      "product_status:known_affected": "455",
      "product_status:known_not_affected": "109",
      "product_status:recommended": "577",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48967",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48967.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48967",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:19:37.596608Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:19:40.710Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/nfc/nci/ntf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "6b37f0dc0638d13a006f2f24d2f6ca61e83bc714",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "dbdcfb9f6748218a149f62468d6297ce3f014e9c",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "cff35329070b96b4484d23f9f48a5ca2c947e750",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "6778434706940b8fad7ef35f410d2b9929f256d2",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "908b2da426fe9c3ce74cf541ba40e7a4251db191",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "f41547546db9af99da2c34e3368664d7a79cefae",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "e329e71013c9b5a4535b099208493c7826ee4a64",
                  "status": "affected",
                  "version": "019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/nfc/nci/ntf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.4"
                },
                {
                  "lessThan": "3.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.336",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.302",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.269",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.227",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.159",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.83",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.1",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.336",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.302",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.269",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.227",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.159",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.83",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.13",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1",
                      "versionStartIncluding": "3.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target-\u003esensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The overflow is reached while parsing NCI RF_DISCOVER_NTF frames delivered by the NFC controller from an NFC peer/tag in RF range (nci_recv_frame \u2192 nci_rx_work \u2192 nci_ntf_packet \u2192 nci_rf_discover_ntf_packet \u2192 nci_add_new_protocol), matching established AV:A scoring for NCI bugs (CVE-2024-35915, CVE-2024-38381, CVE-2023-52502).\nAC:L - A single crafted Discover NTF (e.g. NFC-F with rf_tech_specific_params_len=0 leaving sensf_res_len uninitialized, or any path that supplies a length \u003e array size) deterministically drives the unbounded memcpy; ~93% of random u8 lengths exceed the 18-byte field, with no race or attacker-uncontrollable precondition.\nPR:N - NFC discovery notifications are processed with no authentication from an adjacent peer while the platform NFC stack is polling, and the same parser is reachable via N_NCI without credentials; no attacker-held capability is required on the severe path.\nUI:N - Frames are handled asynchronously on nci_rx_work during normal autonomous NFC poll/discovery; no victim action such as mounting a filesystem or confirming a prompt is required.\nS:U - The out-of-bounds write corrupts kernel heap state inside struct nci_dev (targets[] and adjacent fields) within the host OS security authority, with no VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - The oversized memcpy both reads past the 18-byte source on the stack and writes past target-\u003esensf_res into adjacent nfc_target/nci_dev heap memory, and the inflated sensf_res_len is later exported via nfc_genl_send_target netlink attributes\u2014memory corruption with a disclosure path, scored Confidentiality High.\nI:H - This is a genuine heap out-of-bounds write of up to 255 bytes into ndev-\u003etargets[] (and past the array for late indices into n_targets and following nci_dev fields), enabling corruption of kernel NFC state and control-flow primitives per OOB-write guidance.\nA:H - Syzkaller already hit a fortify WARNING that panics under panic_on_warn, and an unbounded heap write in workqueue context reliably produces kernel oops/panic even when not fully exploited."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:53:11.975Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83bc714"
            },
            {
              "url": "https://git.kernel.org/stable/c/dbdcfb9f6748218a149f62468d6297ce3f014e9c"
            },
            {
              "url": "https://git.kernel.org/stable/c/cff35329070b96b4484d23f9f48a5ca2c947e750"
            },
            {
              "url": "https://git.kernel.org/stable/c/6778434706940b8fad7ef35f410d2b9929f256d2"
            },
            {
              "url": "https://git.kernel.org/stable/c/27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9"
            },
            {
              "url": "https://git.kernel.org/stable/c/908b2da426fe9c3ce74cf541ba40e7a4251db191"
            },
            {
              "url": "https://git.kernel.org/stable/c/f41547546db9af99da2c34e3368664d7a79cefae"
            },
            {
              "url": "https://git.kernel.org/stable/c/e329e71013c9b5a4535b099208493c7826ee4a64"
            }
          ],
          "title": "NFC: nci: Bounds check struct nfc_target arrays",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48967",
        "datePublished": "2024-10-21T20:05:49.740Z",
        "dateReserved": "2024-08-22T01:27:53.628Z",
        "dateUpdated": "2026-08-05T08:53:11.975Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.