Vulnerability in Kernel: NULL ptr dereference in llcp_sock_getname() after failed connect
Summary
GSD-2021-1000754: nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect. Affects Kernel versions >= d646960f7986fefb460a2b062d5ccc8ccfeacc3a, < 5d4c4b06ed9fb7a69d0b2e2a73fc73226d25ab70. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It is a critical part of the system's functionality and security. This vulnerability specifically affects the Kernel's NFC (Near Field Communication) module. NFC allows devices to communicate wirelessly over short distances, enabling various applications such as contactless payments and data transfer. The llcp_sock_getname() function in the NFC module is susceptible to a NULL pointer dereference after a failed connect operation.
Vulnerability Detail
The vulnerability arises due to a programming error in the llcp_sock_getname() function of the NFC module. When a connect operation fails, the function does not properly handle the NULL pointer, leading to a dereference issue. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Kernel to the recommended version.
Conclusion
In conclusion, this vulnerability in the Kernel's NFC module can lead to a NULL pointer dereference after a failed connect operation. It is recommended to update the Kernel to version v5.4.125 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software.
NFC (Near Field Communication) is a technology that allows devices to communicate wirelessly over short distances, enabling various applications such as contactless payments and data transfer.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a pointer that has not been assigned a valid memory address (i.e., it points to NULL). This can lead to crashes, unexpected behavior, or security vulnerabilities.
A denial-of-service (DoS) attack is an attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or malicious activities. In the context of this vulnerability, an attacker could potentially exploit it to cause a DoS condition in the Kernel.
To update the Linux Kernel, you can follow the instructions provided by your Linux distribution. Typically, it involves using package management tools or manually compiling and installing the latest Kernel version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
