NFC: NULL out the dev->rfkill to prevent UAF in Kernel
Summary
GSD-2022-1003793: NFC: NULL out the dev->rfkill to prevent UAF. Affects Kernel versions >= 307d2e6cebfca9d92f86c8e2c8e3dd4a8be46ba6, < fbf9c4c714d3cdeb98b6a18e4d057f931cad1d81. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The NFC (Near Field Communication) subsystem within the Kernel allows devices to communicate over short distances. It is commonly used for contactless payments, data transfer, and other applications. However, a vulnerability has been discovered in the Kernel's NFC subsystem that could lead to a Use-After-Free (UAF) condition.
Vulnerability Detail
The vulnerability in the Kernel's NFC subsystem arises from a failure to properly handle a specific scenario, resulting in a Use-After-Free (UAF) condition. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) situation. The issue was introduced in version v5.4.162 of the Linux Kernel and was fixed in version v5.4.198. The vulnerability is tracked under the ID GSD-2022-1003793.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the NFC functionality if it is not required for their specific use case. This can be done by modifying the system configuration or disabling the NFC module. However, it is important to note that disabling NFC may impact certain applications or functionalities that rely on it.
Conclusion
The vulnerability in the Kernel's NFC subsystem can be mitigated by updating to version v5.4.198 or later of the Linux Kernel. It is crucial to keep the Kernel up to date to ensure the security and stability of the system. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) situation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch has been released in version v5.4.198 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
Yes, as a temporary workaround, you can disable NFC if it is not required for your specific use case. However, disabling NFC may impact certain applications or functionalities that rely on it.
You can find more information about this vulnerability in the GSD-2022-1003793 JSON report available on the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
