NFC: NULL out the dev->rfkill to prevent UAF in Kernel
Summary
GSD-2022-1003147: NFC: NULL out the dev->rfkill to prevent UAF. Affects Kernel versions >= 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102, < 4a68938f43b7c2663e4c90bb9bbe29ac8b9a42a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The NFC (Near Field Communication) subsystem within the Kernel facilitates communication between devices in close proximity. It allows for contactless data exchange and is commonly used for applications such as mobile payments and access control systems. However, a vulnerability has been identified in the Kernel's NFC subsystem that could lead to a Use-After-Free (UAF) scenario.
Vulnerability Detail
The vulnerability in the Kernel's NFC subsystem arises from a failure to properly handle a specific scenario, resulting in a Use-After-Free condition. When certain operations are performed on the NFC device, the 'dev->rfkill' pointer is not properly nullified, leaving it susceptible to being accessed after it has been freed. This can potentially lead to a variety of security issues, including remote code execution or privilege escalation. The vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.17.14.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the NFC functionality on their systems until the Kernel is updated. This can be achieved by modifying the system configuration or disabling relevant modules. However, it is strongly advised to apply the official fix as soon as possible to ensure the security and proper functioning of the NFC subsystem.
Conclusion
The vulnerability in the Kernel's NFC subsystem can pose significant security risks, potentially allowing attackers to execute arbitrary code or escalate privileges. It is crucial to update the Linux Kernel to version v5.17.14 or later to mitigate these risks. In the meantime, disabling NFC functionality can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability in the Kernel's NFC subsystem could potentially allow an attacker to execute arbitrary code or escalate privileges on an affected system. This can lead to unauthorized access, data breaches, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this NFC vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in the Kernel's NFC subsystem. However, it is important to apply the fix promptly to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely. An attacker can potentially exploit the vulnerability by sending specially crafted NFC messages to a vulnerable system, leading to the execution of arbitrary code or privilege escalation.
For more detailed information on this vulnerability, including technical specifics and the fix implementation, you can refer to the vulnerability report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003147.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
