Memory Leaks in EVT_TRANSACTION Handling in nfc: st21nfca
Summary
GSD-2022-1003842: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling. Affects Kernel versions >= 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074, < 6fce324b530dd74750ad870699e33eeed1029ded. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfc: st21nfca is a component of the Linux Kernel that provides support for Near Field Communication (NFC) functionality. NFC enables communication between devices in close proximity, allowing for contactless data exchange and payment transactions. The st21nfca driver is responsible for managing the STMicroelectronics ST21NFCA NFC controller. This vulnerability affects the EVT_TRANSACTION handling in the st21nfca driver.
Vulnerability Detail
The vulnerability in the EVT_TRANSACTION handling of the st21nfca driver leads to memory leaks. When processing certain NFC transactions, the driver fails to release allocated memory, resulting in memory leaks. An attacker could potentially exploit this vulnerability to exhaust system memory resources, leading to a denial-of-service condition. The impact of this vulnerability may vary depending on the system's memory management capabilities and the attacker's ability to trigger the vulnerable code path.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
The memory leaks in the EVT_TRANSACTION handling of the nfc: st21nfca driver can be fixed by updating the Linux Kernel to version v4.19.247 or later. This update resolves the vulnerability and prevents potential memory exhaustion attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability may vary depending on the system's memory management capabilities and the attacker's ability to trigger the vulnerable code path. It could potentially lead to a denial-of-service condition by exhausting system memory resources.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to the patched version.
At the time of this report, no known exploits for this vulnerability have been disclosed.
For more information about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
