[PATCH net 0/4] nfc: digital: Fix missing and misplaced length checks

Lekë Hapçiu
2026-04-09T22:35:04Z

This series fixes four length-check bugs in the NFC Digital Protocol stack.
All are reachable from RF without authentication:

- Patch 1: Missing upper-bound check before memcpy into target.sensf_res
in the NFC-F initiator polling path. An oversized SENSF_RES overflows
an 18-byte stack buffer by up to 235 bytes. CVSS 8.1.

- Patch 2: Check-after-read in the NFC-A target receive path.
resp->data[0] is read before the resp->len != 0 guard fires.
A zero-length frame triggers a 1-byte OOB read.

- Patch 3: Missing post-pull length check in the RTOX handler inside
digital_in_recv_dep_res(). After skb_pull strips the 3-byte DEP
header, resp->data[0] is read with no guarantee that any payload byte
remains.

- Patch 4: DID byte accessed at resp->data[3] after only a
sizeof(struct digital_dep_req_res) == 3 byte guard in
digital_tg_recv_dep_req(). An attacker with DID bit set and a 3-byte
frame triggers a 1-byte OOB read.

Patches 1-4 are independent and can be applied in any order.

Security Research (4):
nfc: digital: Fix stack buffer overflow in digital_in_recv_sensf_res()
nfc: digital: Fix check-after-read in digital_tg_recv_sens_req()
nfc: digital: Fix OOB read of RTOX byte in digital_in_recv_dep_res()
nfc: digital: Fix OOB read of DID byte in digital_tg_recv_dep_req()

net/nfc/digital_dep.c | 10 ++++++++--
net/nfc/digital_technology.c | 13 ++++++++-----
2 files changed, 16 insertions(+), 7 deletions(-)