NFC: NULL out the dev->rfkill to prevent UAF in Kernel

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential services and functions, including device drivers, memory management, process management, and system calls. The NFC (Near Field Communication) subsystem in the Kernel enables communication between devices in close proximity, allowing for contactless data transfer. However, a vulnerability has been discovered in the Kernel's NFC subsystem that could lead to a Use-After-Free (UAF) condition.

Vulnerability Detail

The vulnerability in the Kernel's NFC subsystem arises from a failure to properly handle a specific scenario, resulting in a Use-After-Free (UAF) condition. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) situation. The issue originates from the dev->rfkill pointer not being properly set to NULL, which can lead to a dangling pointer after the object is freed. This dangling pointer can be subsequently dereferenced, leading to unexpected behavior and potential security implications.

Workaround

As a workaround, users can apply the patch provided in the commit f81270125b50532624400063281e6611ecd61ddf manually. The patch modifies the relevant code to ensure that the dev->rfkill pointer is properly set to NULL. Here is an example of the patch:

--- a/drivers/nfc/nfcmrvl/main.c
+++ b/drivers/nfc/nfcmrvl/main.c
@@ -123,6 +123,7 @@ static void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv)
 		return;
 
 		nfcmrvl_nci_unregister_rfkill(priv);
+		dev->rfkill = NULL;
 		device_unregister(&priv->dev->dev);
 }

Conclusion

In conclusion, the NFC subsystem in the Linux Kernel is vulnerable to a Use-After-Free (UAF) condition due to the dev->rfkill pointer not being properly set to NULL. This vulnerability can have serious security implications, including the potential execution of arbitrary code or denial-of-service (DoS) attacks. It is crucial to update the Kernel to version v4.14.283 or later to mitigate this vulnerability. If updating is not possible, applying the provided patch manually can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ