Description
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.2.23-1 | — |
| Debian 13 | linux | 3.2.23-1 | — |
| Debian 12 | linux | 3.2.23-1 | — |
References
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.5
- [oss-security] 20120627 Re: CVE Request: Kernel [PATCH] NFC: prevent multiple buffer overflows in NCI mailing-list
- https://github.com/torvalds/linux/commit/67de956ff5dc1d4f321e16cfbd63f5be3b691b43
- USN-1529-1 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=67de956ff5dc1d4f321e16cfbd63f5be3b691b43
- [linux-kernel] 20120612 [PATCH] NFC: prevent multiple buffer overflows in NCI mailing-list