Use-after-free vulnerability in net/nfc package
Summary
GSD-2021-1000309: net/nfc: fix use-after-free llcp_sock_bind/connect. Affects Kernel versions >= c33b1cc62ac05c1dbb1cdafe2eb66da01c76ca8d, < 18175fe17ae043a0b81e5d511f8817825784c299. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/nfc package is a part of the Linux Kernel ecosystem and is responsible for handling Near Field Communication (NFC) functionality. NFC enables communication between devices in close proximity, allowing for contactless data exchange. The package provides various features and protocols for NFC communication, including the Logical Link Control Protocol (LLCP).
Vulnerability Detail
The vulnerability identified in the net/nfc package is a use-after-free issue specifically related to the llcp_sock_bind/connect functions. A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, leading to potential memory corruption and exploitation. In this case, the vulnerability arises from improper handling of socket binding and connection operations in the LLCP implementation. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the latest stable version.
Conclusion
The use-after-free vulnerability in the net/nfc package's llcp_sock_bind/connect functions can lead to memory corruption and potential code execution or denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.12.4 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/nfc package is a component of the Linux Kernel that handles Near Field Communication (NFC) functionality, enabling contactless data exchange between devices.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, potentially leading to memory corruption and exploitation.
An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update the Linux Kernel to version v5.12.4 or later, which includes the necessary patch.
No specific workaround is mentioned for this vulnerability. It is recommended to update the Linux Kernel to the latest stable version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
