Memory Leak Vulnerability in NFC Digital Module of Linux Kernel
Summary
UVI-2021-1001977: NFC: digital: fix possible memory leak in digital_in_send_sdd_req(). Affects Kernel versions >= 2c66daecc4092e6049673c281b2e6f0d5e59a94c, < 071bdef36391958c89af5fa2172f691b31baa212. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for hardware abstraction, process management, memory management, and device drivers. The NFC (Near Field Communication) subsystem within the Linux Kernel enables communication between devices in close proximity, facilitating applications such as contactless payments and data transfer. The digital module of the NFC subsystem handles the digital communication aspects of NFC devices.
Vulnerability Detail
The vulnerability identified as UVI-2021-1001977 affects the digital module of the NFC subsystem in the Linux Kernel. Specifically, the function digital_in_send_sdd_req() is susceptible to a memory leak. A memory leak occurs when dynamically allocated memory is not properly deallocated, leading to a gradual depletion of available memory resources. This vulnerability could potentially be exploited by an attacker to exhaust system memory, resulting in performance degradation or even system instability. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The memory leak vulnerability in the digital module of the NFC subsystem in the Linux Kernel could potentially lead to performance degradation or system instability. It is crucial for users to update their Linux Kernel to a version that includes the fix provided in commit 071bdef36391958c89af5fa2172f691b31baa212. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to performance degradation or system instability due to memory exhaustion.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No known exploit for this vulnerability has been reported at the moment.
The vulnerability was introduced in version v3.13 of the Linux Kernel through commit 2c66daecc4092e6049673c281b2e6f0d5e59a94c. It has been fixed in version v4.19.213 through commit 071bdef36391958c89af5fa2172f691b31baa212.
You can find more information about this vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability entry can be accessed at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/UVI-2021-1001977.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
