Vulnerability in Kernel package: nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
Summary
GSD-2022-1003511: nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION. Affects Kernel versions >= 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074, < cdd9227373f29bd68a1729dc33105026ff3202f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system, responsible for managing the system's core functionality. It provides the necessary interfaces and services for communication between hardware and software components. The nfc (Near Field Communication) subsystem within the Kernel package enables devices to communicate wirelessly over short distances. One of its modules, st21nfca, is responsible for handling transactions in NFC devices. However, a vulnerability has been discovered in the EVT_TRANSACTION function of st21nfca, leading to incorrect sizing calculations. This vulnerability could potentially be exploited by attackers to manipulate transaction data or cause a denial-of-service condition.
Vulnerability Detail
The vulnerability in the EVT_TRANSACTION function of st21nfca arises from incorrect sizing calculations. This can result in buffer overflows or underflows, leading to memory corruption or data manipulation. An attacker could potentially craft malicious NFC transactions to exploit this vulnerability and compromise the integrity of the system. The impact of this vulnerability may vary depending on the specific usage of NFC devices and the level of access an attacker has. However, it is crucial to address this vulnerability promptly to prevent potential security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable NFC functionality on their devices if it is not essential for their operations. Disabling NFC eliminates the potential attack surface for this vulnerability. However, this workaround may not be feasible for systems heavily reliant on NFC functionality. It is recommended to apply the official fix by updating the Kernel package to ensure comprehensive protection against this vulnerability.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's nfc: st21nfca module, specifically in the EVT_TRANSACTION function. This vulnerability arises from incorrect sizing calculations, potentially leading to memory corruption or data manipulation. To mitigate this vulnerability, it is crucial to update the Linux Kernel package to version v5.10.122 or later, which includes the necessary fix. Disabling NFC functionality can serve as a temporary workaround, but it may not be suitable for all systems. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow attackers to manipulate NFC transaction data or cause a denial-of-service condition. The impact may vary depending on the specific usage of NFC devices and the level of access an attacker has.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v5.10.122 or later. This fix is available in commit cdd9227373f29bd68a1729dc33105026ff3202f6.
Yes, disabling NFC functionality on devices can serve as a temporary workaround to eliminate the potential attack surface. However, this may not be feasible for systems heavily reliant on NFC functionality.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is crucial to address this vulnerability promptly to prevent potential security breaches.
For more detailed information about this vulnerability, including its technical aspects and the fix, please refer to the provided references and the official documentation of the Linux Kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
