Vulnerability in Kernel package: nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
Summary
GSD-2021-1000742: nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect. Affects Kernel versions >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a, < 93e4ac2a9979a9a4ecc158409ed9c3044dc0ae1f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The nfc subsystem within the Kernel package enables Near Field Communication (NFC) functionality, allowing devices to exchange data wirelessly over short distances. This vulnerability specifically affects the llcp_sock_getname() function within the nfc subsystem.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the llcp_sock_getname() function after a failed connection attempt. This issue can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. The vulnerability was introduced in version v3.3 of the Linux Kernel and has been fixed in version v4.19.194.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel package is not immediately feasible, a possible workaround is to disable the NFC functionality or restrict access to the affected subsystem. This can be achieved by modifying the system configuration or using kernel command-line parameters. However, it is important to note that workarounds may have limitations and it is still advisable to apply the official fix as soon as possible.
Conclusion
In conclusion, the Kernel package in Linux is vulnerable to a NULL pointer dereference issue in the llcp_sock_getname() function within the nfc subsystem. This vulnerability can result in a denial-of-service condition or potential execution of arbitrary code with kernel privileges. It is crucial to update the Linux Kernel package to version v4.19.194 or later to mitigate this vulnerability. If immediate updating is not possible, consider applying workarounds such as disabling NFC functionality or restricting access to the affected subsystem. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service condition or potential execution of arbitrary code with kernel privileges.
You can check the version of the Linux Kernel package installed on your system. If it is a version between v3.3 and v4.19.193, your system may be affected.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security patches promptly to mitigate potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network and the necessary conditions are met.
For more details about this vulnerability, including technical specifics and the fix implementation, refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
