Use-after-free vulnerability in net/nfc package
Summary
GSD-2021-1000440: net/nfc: fix use-after-free llcp_sock_bind/connect. Affects Kernel versions >= c89903c9eff219a4695e63715cf922748d743f65, < e32352070bcac22be6ed8ab635debc280bb65b8c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/nfc package is a part of the Linux Kernel and is responsible for handling Near Field Communication (NFC) functionality. NFC allows devices to communicate wirelessly over short distances, enabling various applications such as contactless payments and data transfer. The package provides the necessary protocols and drivers for NFC communication. However, a use-after-free vulnerability has been identified in the llcp_sock_bind/connect functions of the package, which can lead to potential security issues.
Vulnerability Detail
The use-after-free vulnerability in the net/nfc package occurs when the llcp_sock_bind/connect functions are used. This vulnerability allows an attacker to exploit a freed memory region, leading to a use-after-free condition. By manipulating the freed memory, an attacker can potentially execute arbitrary code or cause a denial-of-service (DoS) condition. The vulnerability was introduced in version v5.4.112 of the Linux Kernel and has been fixed in version v5.4.119 by commit e32352070bcac22be6ed8ab635debc280bb65b8c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The use-after-free vulnerability in the net/nfc package of the Linux Kernel can have serious security implications. It is crucial to update the kernel to version v5.4.119 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/nfc package is a component of the Linux Kernel that provides support for Near Field Communication (NFC) functionality. It enables devices to communicate wirelessly over short distances, facilitating applications like contactless payments and data transfer.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including the potential execution of arbitrary code or a denial-of-service (DoS) condition.
The use-after-free vulnerability in the net/nfc package can be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. This can potentially lead to unauthorized access, data breaches, or system instability.
Yes, the use-after-free vulnerability in the net/nfc package has been fixed in version v5.4.119 of the Linux Kernel. Users are advised to update their kernel to this version or later to mitigate the vulnerability.
The updated Linux Kernel, which includes the fix for the use-after-free vulnerability in the net/nfc package, can be obtained from the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
