NFC: digital: Fix possible memory leak in digital_in_send_sdd_req()
Summary
GSD-2021-1002000: NFC: digital: fix possible memory leak in digital_in_send_sdd_req(). Affects Kernel versions >= 2c66daecc4092e6049673c281b2e6f0d5e59a94c, < 2bde4aca56db9fe25405d39ddb062531493a65db. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) digital module is a component of the Linux Kernel. It provides support for NFC communication protocols and enables devices to interact with NFC-enabled devices such as smartphones, contactless payment systems, and access control systems. The digital_in_send_sdd_req() function is responsible for sending a Secure Digital Data (SDD) request in the digital module.
Vulnerability Detail
The digital_in_send_sdd_req() function in the NFC digital module has a potential memory leak vulnerability. This vulnerability could lead to memory exhaustion and impact the overall system performance. An attacker may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges. The vulnerability was introduced in version v3.13 of the Linux Kernel and has been fixed in version v5.4.155.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Linux Kernel to the latest version.
Conclusion
The NFC digital module in the Linux Kernel has a potential memory leak vulnerability in the digital_in_send_sdd_req() function. This vulnerability can lead to memory exhaustion and impact system performance. It is crucial to update the Linux Kernel to version v5.4.155 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to memory exhaustion and impact system performance. It may also allow an attacker to cause a denial-of-service condition or execute arbitrary code with elevated privileges.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There is no known exploit for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate any potential risks.
There is no known workaround for this vulnerability. It is recommended to update the Linux Kernel to the latest version as soon as possible.
You can find more information about this vulnerability in the Linux Kernel's Git repository. The vulnerability is tracked under the ID GSD-2021-1002000 (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002000.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
