Memory Leak Vulnerability in NFC: nci: fix memory leak in nci_allocate_device
Summary
UVI-2021-1000684: NFC: nci: fix memory leak in nci_allocate_device. Affects Kernel versions >= 11f54f228643d0248ec00ce8c9fb8d872f87e7b8, < 2c2fb2df46ea866b49fea5ec7112ec3cd4896c74. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NFC (Near Field Communication) package in the Linux Kernel is responsible for handling communication between devices in close proximity. It enables features such as contactless payments, file sharing, and device pairing. The nci_allocate_device function is a crucial component of the NFC package, responsible for allocating memory resources for device initialization. However, a memory leak vulnerability has been discovered in this function, which can lead to the exhaustion of system memory over time.
Vulnerability Detail
The memory leak vulnerability in nci_allocate_device arises from a failure to release allocated memory when an error occurs during device initialization. This can result in a gradual depletion of available memory resources, eventually leading to system instability or denial of service. Attackers may be able to exploit this vulnerability to exhaust system memory intentionally, causing a system crash or making it unresponsive. The vulnerability was introduced in version v4.0 of the Linux Kernel and has been fixed in version v4.14.235.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the impact of this vulnerability by restarting the affected system periodically to free up memory resources. However, this is not a permanent solution and should be considered only until the Kernel can be updated to a fixed version.
Conclusion
The memory leak vulnerability in NFC's nci_allocate_device function can lead to the gradual depletion of system memory, potentially causing system instability or denial of service. It is crucial to update the Linux Kernel to version v4.14.235 or later to mitigate this vulnerability. Restarting the affected system periodically can serve as a temporary workaround until the Kernel is updated. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
NFC (Near Field Communication) is a technology that enables short-range wireless communication between devices, typically within a few centimeters. It is commonly used for contactless payments, file sharing, and device pairing.
nci_allocate_device is a function in the NFC package of the Linux Kernel that is responsible for allocating memory resources for device initialization.
A memory leak occurs when a program or system fails to release allocated memory after it is no longer needed. This can lead to a gradual depletion of available memory resources, potentially causing system instability or denial of service.
The memory leak vulnerability in nci_allocate_device can result in the exhaustion of system memory over time. This can lead to system instability, crashes, or unresponsiveness, potentially impacting the availability and reliability of the affected system.
You can use Vulert's vulnerability playground (https://vulert.com/scanner) to check if your application or system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
