NFC: Race Condition Vulnerability in Linux Kernel
Summary
GSD-2021-1002312: NFC: add NCI_UNREG flag to eliminate the race. Affects Kernel versions >= 6a2968aaf50c7a22fced77a5e24aa636281efca8, < ed35e950d8e5658db5b45526be2c4e3778746909. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality and interfaces for hardware, software, and user applications. The Near Field Communication (NFC) subsystem in the Linux Kernel enables communication between devices in close proximity, facilitating contactless transactions and data exchange. However, a race condition vulnerability has been identified in the NFC subsystem, potentially leading to security issues.
Vulnerability Detail
The race condition vulnerability in the NFC subsystem arises from a lack of synchronization when unregistering a device. This can result in a race condition where a device is unregistered while it is still being used, leading to undefined behavior and potential security vulnerabilities. Attackers may exploit this vulnerability to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition. The vulnerability was introduced in version v3.2 of the Linux Kernel and has been fixed in version v5.15.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the NFC subsystem or restrict its usage to trusted devices only. This can be achieved by modifying the kernel configuration or using kernel command-line parameters. However, this workaround may impact the functionality of NFC-related applications and should be considered as a temporary measure until the kernel is updated.
Conclusion
The race condition vulnerability in the NFC subsystem of the Linux Kernel can lead to security issues and potential exploitation. It is crucial to update the kernel to version v5.15.5 or later, which includes the necessary fix. In the meantime, users can employ the temporary workaround of disabling or restricting the NFC subsystem. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by attackers to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Yes, a temporary workaround is to disable the NFC subsystem or restrict its usage to trusted devices. However, this may impact the functionality of NFC-related applications.
Yes, the vulnerability has been fixed in Linux Kernel version v5.15.5. It is recommended to update to this version or later to mitigate the risk.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1002312.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
