CVE-2024-35915 – A vulnerability in the Linux kernel's NFC (Near... (How to Fix)

Q: What is the severity of CVE-2024-35915?

CVE-2024-35915 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem allows reading uninitialized memory when processing packets with zero-length payloads. This affects systems with NFC hardware enabled and could lead to information disclosure or kernel crashes. The issue impacts Linux systems with NFC functionality.

📋 TL;DR

A vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem allows reading uninitialized memory when processing packets with zero-length payloads. This affects systems with NFC hardware enabled and could lead to information disclosure or kernel crashes. The issue impacts Linux systems with NFC functionality.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions with NFC support

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if NFC subsystem is enabled and in use. Many servers and systems without NFC hardware are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Information disclosure of kernel memory contents, potentially exposing sensitive data or leading to kernel panic and denial of service.

🟠

Likely Case

Kernel crash or system instability when processing malformed NFC packets, resulting in denial of service.

🟢

If Mitigated

No impact if NFC functionality is disabled or systems are not using NFC hardware.

🌐 Internet-Facing: LOW - NFC requires physical proximity, not internet connectivity.

🏢 Internal Only: MEDIUM - Requires physical access or local network NFC communication.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires ability to send malformed NFC packets, which typically requires physical proximity or local network access to NFC hardware.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes (see references)

Vendor Advisory: https://git.kernel.org/stable/c/03fe259649a551d336a7f20919b641ea100e3fff

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable NFC functionality

linux

Disable NFC kernel modules if not needed

modprobe -r nci
echo 'blacklist nci' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable NFC hardware at BIOS/UEFI level if possible
Implement physical security controls to prevent unauthorized NFC device access

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if NFC modules are loaded: lsmod | grep -i nci

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test NFC functionality

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
NFC subsystem error messages in dmesg

Network Indicators:

Unusual NFC communication patterns

SIEM Query:

source="kernel" AND ("nci" OR "NFC") AND ("panic" OR "oops" OR "BUG")

📊 Metadata

CVE ID: CVE-2024-35915

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

Published: May 19, 2024

Last Updated: February 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35915, you might also want to check these: