NFC: digital: Fix possible memory leak in digital_tg_listen_mdaa() in Kernel
Summary
GSD-2021-1001775: NFC: digital: fix possible memory leak in digital_tg_listen_mdaa(). Affects Kernel versions >= 1c7a4c24fbfd99442cc6e14dc80fcb00f118e8b8, < 429054ec51e648d241a7e0b465cf44f6633334c5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions to enable the proper functioning of the system. The NFC (Near Field Communication) subsystem in the Kernel allows devices to communicate wirelessly over short distances. The digital_tg_listen_mdaa() function in the NFC digital driver is responsible for handling the listening mode of the NFC target. However, a possible memory leak vulnerability has been identified in this function.
Vulnerability Detail
The vulnerability in digital_tg_listen_mdaa() can lead to a memory leak, which occurs when memory is allocated but not properly deallocated, resulting in a gradual depletion of available memory resources. An attacker could potentially exploit this vulnerability to exhaust system memory, leading to a denial-of-service condition or other unpredictable behavior. The vulnerability was introduced in Kernel version v3.13 and has been fixed in version v4.4.290 by commit 429054ec51e648d241a7e0b465cf44f6633334c5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to disable the NFC functionality or restrict access to the vulnerable code. This can be achieved by modifying the system configuration or using kernel command-line parameters to exclude the NFC module from loading. However, it is important to note that workarounds may have limitations and it is still recommended to apply the official fix as soon as possible.
Conclusion
The NFC digital driver in the Kernel is vulnerable to a memory leak issue in the digital_tg_listen_mdaa() function. This vulnerability can potentially lead to system instability and denial-of-service conditions. It is crucial to update the Kernel to version v4.4.290 or later to mitigate this vulnerability. If immediate update is not possible, disabling the NFC functionality or restricting access to the vulnerable code can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to a memory leak, which may result in system instability, resource exhaustion, or denial-of-service conditions.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there is no known exploit for this vulnerability. However, it is still important to apply the fix to prevent potential future exploits.
While updating the Kernel is the recommended solution, you can mitigate the vulnerability by disabling the NFC functionality or restricting access to the vulnerable code. However, it is still advisable to apply the official fix as soon as possible.
You can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001775.json) for more information about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
