Memory Leak Vulnerability in NFC: nci_allocate_device
Summary
GSD-2021-1000711: NFC: nci: fix memory leak in nci_allocate_device. Affects Kernel versions >= 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 448a1cb12977f52142e6feb12022c59662d88dc1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The NFC (Near Field Communication) subsystem in the Linux Kernel enables communication between devices over short distances. It provides support for various NFC protocols and devices. One of the components in the NFC subsystem is nci_allocate_device, which is responsible for allocating memory for an NFC device. However, a memory leak vulnerability has been identified in this function.
Vulnerability Detail
The memory leak vulnerability in nci_allocate_device allows an attacker to allocate memory repeatedly without freeing it, leading to a depletion of available memory resources. This can result in system instability, performance degradation, or even denial of service if the memory exhaustion reaches critical levels. The vulnerability was introduced in version v4.0 of the Linux Kernel and has been fixed in version v4.4.271.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by manually freeing the allocated memory after its use in the affected code. Here is an example of how to free the memory in C:
void nci_allocate_device() {
// Vulnerable code
// Allocate memory
void* memory = malloc(size);
// Use the allocated memory
// ...
// Free the memory
free(memory);
}
Conclusion
The memory leak vulnerability in nci_allocate_device can have severe consequences on system stability and performance. It is essential to update the Linux Kernel to version v4.4.271 or later to fix this vulnerability. If immediate update is not possible, implementing the provided workaround can help mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The memory leak vulnerability can lead to memory exhaustion, causing system instability, performance degradation, or denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities, including this memory leak vulnerability.
Yes, a patch for this vulnerability is available in the Linux Kernel version v4.4.271 or later. It is recommended to update the Kernel to apply the patch.
While updating the Kernel is the recommended approach, you can temporarily mitigate the vulnerability by manually freeing the allocated memory after its use in the affected code. Refer to the workaround section for more details.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to apply the patch or workaround to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
