Memory Leak Vulnerability in NFC: nci: fix memory leak in nci_allocate_device
Summary
GSD-2021-1000574: NFC: nci: fix memory leak in nci_allocate_device. Affects Kernel versions >= 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 65234f50a90b64b335cbb9164b8a98c2a0d031dd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) package in the Linux Kernel is responsible for handling communication between devices in close proximity. It enables various applications such as contactless payments, data transfer, and device pairing. The nci_allocate_device function is a critical component of the NFC package, responsible for allocating memory for device initialization. However, a memory leak vulnerability has been identified in this function, which can lead to the exhaustion of system resources over time.
Vulnerability Detail
The memory leak vulnerability in nci_allocate_device arises from a failure to release allocated memory when an error occurs during device initialization. This can result in a gradual depletion of available memory resources, leading to system instability or even denial of service. Attackers may exploit this vulnerability by repeatedly triggering the device initialization process, causing a significant impact on system performance and availability. The vulnerability was introduced in version v4.0 of the Linux Kernel and has been fixed in version v5.12.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Linux Kernel, there is no specific workaround available. It is strongly advised to update the Kernel to the latest version to mitigate the risk of memory leaks.
Conclusion
The memory leak vulnerability in NFC's nci_allocate_device function can have severe consequences on system performance and availability. It is crucial to update the Linux Kernel to the latest version (v5.12.8 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a technology that allows devices in close proximity to communicate wirelessly. It enables various applications such as contactless payments, data transfer, and device pairing.
The nci_allocate_device function is a critical component of the NFC package in the Linux Kernel. It is responsible for allocating memory for device initialization.
A memory leak vulnerability occurs when allocated memory is not properly released, leading to a gradual depletion of available memory resources. This can result in system instability or denial of service.
The memory leak vulnerability in nci_allocate_device can lead to system instability or denial of service. Attackers may exploit this vulnerability to exhaust system resources, impacting performance and availability.
To fix this vulnerability, update the Linux Kernel to version v5.12.8 or later, which includes the necessary patch to address the memory leak issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
