NFC: Reordering Logic in nfc_{un,}register_device
Summary
GSD-2021-1002281: NFC: reorder the logic in nfc_{un,}register_device. Affects Kernel versions >= be055b2f89b5842f41363b5655a33dffb51a8294, < 73a0d12114b4bc1a9def79a623264754b9df698e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) functionality in the Linux Kernel is responsible for enabling communication between devices in close proximity. It allows for the exchange of data and commands between devices, such as smartphones and contactless payment terminals. The nfc_{un,}register_device functions are part of the NFC subsystem and are used to register and unregister NFC devices with the kernel. These functions play a crucial role in managing the NFC devices and their associated drivers.
Vulnerability Detail
The vulnerability identified as GSD-2021-1002281 in the Linux Kernel's NFC subsystem involves the incorrect ordering of logic in the nfc_{un,}register_device functions. This vulnerability was introduced in version v3.10 of the Linux Kernel and was fixed in version v5.10.82. The exact impact and attack plausibility of this vulnerability have not been proven yet. However, the incorrect ordering of logic can potentially lead to various security issues, such as memory corruption, privilege escalation, or denial-of-service attacks. It is important to address this vulnerability to ensure the secure operation of NFC devices and prevent potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the latest version.
Conclusion
The vulnerability in the NFC subsystem of the Linux Kernel, identified as GSD-2021-1002281, involves the incorrect ordering of logic in the nfc_{un,}register_device functions. This vulnerability can potentially lead to security issues, such as memory corruption, privilege escalation, or denial-of-service attacks. It is crucial to update the Linux Kernel to version v5.10.82 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a technology that enables short-range wireless communication between devices, typically within a few centimeters. It allows for contactless data exchange and is commonly used in applications like mobile payments, access control, and data transfer between devices.
The nfc_{un,}register_device functions are part of the NFC subsystem in the Linux Kernel. They are responsible for registering and unregistering NFC devices with the kernel. These functions play a crucial role in managing the NFC devices and their associated drivers.
The incorrect ordering of logic in the nfc_{un,}register_device functions can lead to various security risks. These include memory corruption, privilege escalation, or denial-of-service attacks. The exact impact and attack plausibility of this vulnerability have not been proven yet.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
You can find more information about this vulnerability, including the fix and its impact, in the official Linux Kernel repository. The vulnerability ID GSD-2021-1002281 provides specific details and references to the relevant commits in the repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
