CVE-2022-50656

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Clear nfc_target before being used

Fix a slab-out-of-bounds read that occurs in nlaput() called from nfcgenlsendtarget() when target->sensbreslen, which is duplicated from an nfctarget in pn533, is too large as the nfctarget is not properly initialized and retains garbage values. Clear nfc_targets with memset() before they are used.

Found by a modified version of syzkaller.

BUG: KASAN: slab-out-of-bounds in nlaput Call Trace: memcpy nlaput nfcgenldumptargets genllockdumpit netlinkdump __netlinkdumpstart genlfamilyrcvmsgdumpit genlrcvmsg netlinkrcvskb genlrcv netlinkunicast netlinksendmsg socksendmsg ____sys_sendmsg ___sys_sendmsg _syssendmsg dosyscall64