Fwd: NFC SENSF_RES stack buffer overflow leading to kernel code execution

Hi,

It's been almost two months since I reported this, and I haven't heard
back. Reaching out to you directly as the NFC maintainer.

The bug: digital_in_recv_sensf_res() in net/nfc/digital_technology.c
copies resp->len bytes into the 18-byte target.sensf_res buffer with
no upper bound check:

    memcpy(target.sensf_res, sensf_res, resp->len);

An oversized SENSF_RES overwrites the stack including the saved return
address (confirmed on aarch64 -- crash at attacker-controlled address
0xdeadbeefbadc0ffe).

I noticed commit 1bec5698b55a fixed a similar bounds issue in
digital_in_recv_sdd_res but this one was missed. One-line fix:

-   memcpy(target.sensf_res, sensf_res, resp->len);
+   memcpy(target.sensf_res, sensf_res,
+          min_t(int, resp->len, NFC_SENSF_RES_MAXSIZE));

Full PoC (kernel module) in the original report.

Thanks,
Vladimir
---------- Forwarded message ---------
From: vova tokarev <[email protected]>
Date: Fri, Jul 3, 2026 at 4:34 PM
Subject: NFC SENSF_RES stack buffer overflow leading to kernel code
execution
To: <[email protected]>


Hi,

I found a stack buffer overflow in the NFC digital protocol layer that
leads to kernel code execution via return address overwrite.

The function digital_in_recv_sensf_res() in net/nfc/digital_technology.c
copies resp->len bytes into the 18-byte target.sensf_res buffer without
checking that resp->len does not exceed the buffer size. A rogue NFC-F
tag returning a SENSF_RES longer than 18 bytes overflows the stack and
overwrites the caller's saved return address with attacker-controlled data.

The overflow is deterministic (no race, no heap spray) and triggers
automatically during NFC-F polling from ~4cm proximity.

Affected versions: Linux 3.13+ (since NFC digital layer)
Confirmed on: 7.1.0 (aarch64) with KASAN

Attached ZIP contains:
  - nfc_sensf_overflow_report.md    Detailed writeup with root cause, KASAN
output, and suggested fix
  - poc_nfc_sensf_overflow.c        Kernel module PoC (overwrites saved LR
with 0xdeadbeefbadc0ffe)
  - kasan_output.txt                KASAN stack-out-of-bounds report

Suggested fix: check resp->len before the memcpy:
  memcpy(target.sensf_res, sensf_res,
         min_t(int, resp->len, NFC_SENSF_RES_MAXSIZE));

Thank you,
Vladimir Tokarev