Vulnerability in Kernel package: nfc: nci: add flush_workqueue to prevent uaf
Summary
GSD-2022-1000979: nfc: nci: add flush_workqueue to prevent uaf. Affects Kernel versions >= 6a2968aaf50c7a22fced77a5e24aa636281efca8, < edd4600120641e1714e30112e69a548cfb68e067. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as process management, memory management, and device drivers. The nfc (Near Field Communication) subsystem within the Kernel enables communication between devices in close proximity, facilitating tasks like contactless payments and data transfer. However, a vulnerability has been identified in the nfc subsystem, specifically in the nci module, which could lead to a use-after-free (UAF) condition.
Vulnerability Detail
The vulnerability arises due to a missing flush_workqueue call in the nci module of the nfc subsystem. This omission can result in a use-after-free scenario, where a pointer to freed memory is still accessible and can be mistakenly dereferenced. An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition. The impact and feasibility of such attacks have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by manually adding the missing flush_workqueue call to the affected code. The following code snippet demonstrates the addition:
void nci_function() {
// Existing code
...
flush_workqueue(workqueue);
}
Conclusion
The vulnerability in the Kernel package's nfc subsystem, specifically in the nci module, can be mitigated by updating to the latest version of the Linux Kernel. Alternatively, a temporary workaround can be implemented by manually adding the missing flush_workqueue call. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system, responsible for managing core system functionality.
The nfc (Near Field Communication) subsystem enables communication between devices in close proximity, facilitating tasks like contactless payments and data transfer.
A use-after-free vulnerability occurs when a program continues to use a pointer to memory that has already been freed, potentially leading to unexpected behavior or security issues.
An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition.
The impact and feasibility of exploiting this vulnerability have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
