Memory Leak in NFC: nci_allocate_device
Summary
GSD-2021-1000645: NFC: nci: fix memory leak in nci_allocate_device. Affects Kernel versions >= 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < af2a4426baf71163c0c354580ae98c7888a9aba7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) functionality in the Linux Kernel is responsible for enabling communication between devices in close proximity. It allows for the exchange of data and facilitates various applications such as contactless payments, file sharing, and device pairing. The nci_allocate_device function is a part of the NFC Core Interface (NCI) subsystem and is used to allocate memory for an NFC device. However, a memory leak vulnerability has been identified in this function, which can lead to the exhaustion of system resources over time.
Vulnerability Detail
The memory leak vulnerability in nci_allocate_device arises due to a failure to release allocated memory when an error condition occurs during device initialization. This can result in a gradual depletion of available memory, potentially leading to system instability or denial of service. An attacker with access to the affected system may be able to exploit this vulnerability to exhaust system resources, causing a degradation in performance or even a complete system crash. The vulnerability was introduced in version v4.0 of the Linux Kernel and has been fixed in version v5.4.123.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the impact of this vulnerability by limiting the usage of NFC functionality or disabling it entirely if not required. This can be achieved by modifying system configurations or blacklisting the relevant kernel modules. However, it is important to note that this workaround may result in the loss of NFC-related features and functionality.
Conclusion
The memory leak vulnerability in NFC: nci_allocate_device can have serious consequences for system stability and performance. It is crucial to update the Linux Kernel to the patched version or apply the recommended workaround to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a short-range wireless communication technology that enables the exchange of data between devices in close proximity. It is commonly used for contactless payments, file sharing, and device pairing.
nci_allocate_device is a function in the NFC Core Interface (NCI) subsystem of the Linux Kernel. It is responsible for allocating memory for an NFC device during initialization.
A memory leak is a software defect where allocated memory is not properly released, leading to a gradual depletion of available memory. In this vulnerability, a memory leak occurs in nci_allocate_device when an error condition is encountered during device initialization.
The memory leak vulnerability in nci_allocate_device can result in the exhaustion of system resources over time. This can lead to system instability, performance degradation, or even a complete system crash.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any open-source vulnerabilities, including this one, are detected.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
