Memory Leaks in EVT_TRANSACTION Handling in nfc: st21nfca
Summary
GSD-2022-1003700: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling. Affects Kernel versions >= 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074, < 3eca2c42daa4659965db6817479027cbc6df7899. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfc: st21nfca is a component of the Linux Kernel that provides support for Near Field Communication (NFC) devices using the ST21NFCA chipset. NFC enables short-range communication between devices, allowing for contactless data exchange and payment transactions. The st21nfca driver in the Linux Kernel handles the communication with these NFC devices. However, a vulnerability has been discovered in the EVT_TRANSACTION handling of the st21nfca driver, leading to memory leaks.
Vulnerability Detail
The vulnerability in the EVT_TRANSACTION handling of nfc: st21nfca driver can result in memory leaks. When processing certain NFC transactions, the driver fails to release allocated memory, leading to a gradual depletion of available memory resources. An attacker could potentially exploit this vulnerability by repeatedly triggering the EVT_TRANSACTION event, causing a denial-of-service condition or even a system crash due to memory exhaustion. This vulnerability was introduced in version v4.0 of the Linux Kernel and has been fixed in version v5.4.198.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the NFC functionality or unload the st21nfca driver module if it is not essential for their system's operation. Disabling NFC or unloading the driver prevents the vulnerable code from being executed, mitigating the risk of memory leaks. However, this workaround may not be feasible for systems that rely on NFC functionality.
Conclusion
The vulnerability in the EVT_TRANSACTION handling of nfc: st21nfca driver can lead to memory leaks, potentially causing a denial-of-service condition or system crash. It is crucial to update the Linux Kernel to version v5.4.198 or later to fix this vulnerability. Disabling NFC functionality or unloading the st21nfca driver module can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability in the EVT_TRANSACTION handling of nfc: st21nfca can lead to memory leaks, potentially causing a gradual depletion of available memory resources. This can result in a denial-of-service condition or even a system crash due to memory exhaustion.
An attacker can exploit this vulnerability by repeatedly triggering the EVT_TRANSACTION event, causing the driver to fail in releasing allocated memory. This can lead to a gradual depletion of available memory resources, resulting in a denial-of-service condition or system crash.
The vulnerability was introduced in version v4.0 of the Linux Kernel. All versions between v4.0 and v5.4.198 are potentially affected. The vulnerability has been fixed in version v5.4.198.
Yes, users can disable the NFC functionality or unload the st21nfca driver module if it is not essential for their system's operation. This prevents the vulnerable code from being executed, mitigating the risk of memory leaks. However, this workaround may not be feasible for systems that rely on NFC functionality.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.198 or later. This update includes the commit 3eca2c42daa4659965db6817479027cbc6df7899, which addresses the memory leaks in the EVT_TRANSACTION handling of nfc: st21nfca.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
