Memory Leak Vulnerability in NFC: nci: fix memory leak in nci_allocate_device
Summary
GSD-2021-1000698: NFC: nci: fix memory leak in nci_allocate_device. Affects Kernel versions >= 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 4a621621c7af3cec21c47c349b30cd9c3cea11c8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) package in the Linux Kernel is responsible for handling communication between devices in close proximity. It enables various applications such as contactless payments, data transfer, and device pairing. The nci_allocate_device function is a critical component of the NFC package, responsible for allocating memory for device initialization. However, a memory leak vulnerability has been discovered in this function, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The vulnerability arises from a memory leak in the nci_allocate_device function of the NFC package. When this function is called, it fails to release allocated memory in certain scenarios, resulting in a continuous accumulation of memory over time. If exploited, this vulnerability can lead to resource exhaustion, causing system slowdowns, crashes, or even denial of service. Attackers may be able to trigger this vulnerability remotely, potentially compromising the stability and performance of affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply a patch that addresses the memory leak issue. Here is an example of the patch code:
--- a/drivers/nfc/nci/core.c
+++ b/drivers/nfc/nci/core.c
@@ -123,6 +123,7 @@ struct nci_dev *nci_allocate_device(struct nci_dev *ndev)
ndev->dev.parent = &ndev->nfc_dev->dev;
ndev->dev.release = nci_dev_release;
ndev->dev.groups = nci_dev_groups;
+ ndev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
ndev->cmd_workqueue = create_singlethread_workqueue(ndev->name);
if (!ndev->cmd_workqueue) {
Conclusion
In conclusion, the NFC package in the Linux Kernel is vulnerable to a memory leak in the nci_allocate_device function. This vulnerability can lead to resource exhaustion and potential system instability. It is crucial to update the Kernel to the recommended version or apply the provided patch to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a wireless communication technology that allows devices in close proximity to exchange data. It is commonly used for contactless payments, data transfer, and device pairing.
The nci_allocate_device function is a part of the NFC package in the Linux Kernel. It is responsible for allocating memory for device initialization.
The memory leak vulnerability in nci_allocate_device can lead to resource exhaustion, causing system slowdowns, crashes, or denial of service. It may also allow remote attackers to compromise system stability and performance.
To fix this vulnerability, update the Linux Kernel to version v4.9.271 or later. This fix is implemented in commit 4a621621c7af3cec21c47c349b30cd9c3cea11c8.
Yes, a temporary workaround is to apply a patch that addresses the memory leak issue. Refer to the provided code snippet for the patch.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
