UAF Vulnerability in nfc: nci Package
Summary
GSD-2022-1002389: nfc: nci: add flush_workqueue to prevent uaf. Affects Kernel versions >= 6a2968aaf50c7a22fced77a5e24aa636281efca8, < 9d243aff5f7e6b04e907c617426bbdf26e996ac8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nfc: nci package is a component of the Linux Kernel, which is responsible for handling Near Field Communication (NFC) functionality. NFC enables communication between devices in close proximity, allowing for contactless data transfer and payment transactions. The nfc: nci package implements the NFC Controller Interface (NCI) protocol, which facilitates communication between the NFC hardware and the operating system. This vulnerability affects versions of the Linux Kernel from v3.2 to v4.14.276.
Vulnerability Detail
The UAF (Use-After-Free) vulnerability in the nfc: nci package arises from a missing flush_workqueue call. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The vulnerability occurs when a workqueue is not properly flushed, leading to a use-after-free scenario where a pointer to a freed object is still accessible. An attacker could manipulate this pointer to execute malicious code or crash the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by manually adding the flush_workqueue call to the affected code. The following code snippet demonstrates the addition of the flush_workqueue call:
void nci_flush_workqueue(struct nci_dev *ndev)
{
flush_workqueue(ndev->workqueue);
}
By adding this code, the workqueue will be properly flushed, mitigating the use-after-free vulnerability.
Conclusion
The UAF vulnerability in the nfc: nci package of the Linux Kernel can potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. It is crucial to update the Kernel to version v4.14.276 or later to fix this vulnerability. In the meantime, a temporary workaround can be implemented by adding the flush_workqueue call to the affected code. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. It is crucial to patch the affected systems to prevent any potential exploitation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this UAF vulnerability in the nfc: nci package.
As of now, there are no known instances of this vulnerability being actively exploited. However, it is crucial to apply the necessary patches or updates to prevent any potential exploitation.
While updating the Kernel is the recommended approach, a temporary workaround can be implemented by manually adding the flush_workqueue call to the affected code. This will mitigate the use-after-free vulnerability until the Kernel can be updated.
For further support and assistance in vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your systems.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
