NFC: Reordering Logic in nfc_{un,}register_device
Summary
GSD-2021-1002247: NFC: reorder the logic in nfc_{un,}register_device. Affects Kernel versions >= be055b2f89b5842f41363b5655a33dffb51a8294, < c45cea83e13699bdfd47842e04d09dd43af4c371. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) functionality is a feature in the Linux Kernel that enables short-range wireless communication between devices. It allows for contactless data exchange and is commonly used for applications like mobile payments and file sharing. The vulnerability in question relates to the logic in the nfc_{un,}register_device functions, which are responsible for registering and unregistering NFC devices in the kernel.
Vulnerability Detail
The vulnerability arises from a logic flaw in the nfc_{un,}register_device functions. The logic is not properly ordered, which can lead to potential security vulnerabilities. While the exact impact and attack plausibility have not been proven, this flaw could potentially be exploited by malicious actors to gain unauthorized access or perform other malicious activities. The vulnerability was introduced in Linux Kernel version v3.10 and has been fixed in version v4.19.218 by commit c45cea83e13699bdfd47842e04d09dd43af4c371.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the NFC functionality in the Linux Kernel is vulnerable due to a logic flaw in the nfc_{un,}register_device functions. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v4.19.218 or later. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a short-range wireless communication technology that allows devices to exchange data over a distance of a few centimeters. It is commonly used for applications like mobile payments, file sharing, and contactless identification.
The exact impact of this vulnerability is not known, but it could potentially be exploited by attackers to gain unauthorized access or perform other malicious activities on systems with vulnerable versions of the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will analyze and alert you in real-time for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability has been included in Linux Kernel version v4.19.218. It is recommended to update to this version or a later one to mitigate the vulnerability.
You can find more information about this vulnerability in the GSD-2021-1002247 JSON report available on the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002247.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
