Vulnerability in Kernel package: nfc: nci: add flush_workqueue to prevent uaf
Summary
GSD-2022-1002465: nfc: nci: add flush_workqueue to prevent uaf. Affects Kernel versions >= 6a2968aaf50c7a22fced77a5e24aa636281efca8, < 7d3232214ca4ea8f7d18df264c3b254aa8089d7f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system that provides core functionality and acts as an interface between the hardware and software layers. It includes various subsystems and drivers responsible for managing system resources and facilitating communication between different components. One such subsystem is the nfc (Near Field Communication) subsystem, which enables communication between devices in close proximity. The nci (NFC Controller Interface) module within the nfc subsystem handles the low-level communication with NFC controllers. However, a vulnerability has been identified in the nci module that could lead to a use-after-free (UAF) issue.
Vulnerability Detail
The vulnerability in the nci module arises due to a missing flush_workqueue call. This missing call can result in a use-after-free condition, where a pointer to a deallocated memory object is still accessed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v3.2 of the Linux Kernel by commit 6a2968aaf50c7a22fced77a5e24aa636281efca8 and has been fixed in version v4.9.311 by commit 7d3232214ca4ea8f7d18df264c3b254aa8089d7f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel package's nci module can lead to a use-after-free issue, potentially enabling arbitrary code execution or causing a denial-of-service condition. It is crucial to update the Linux Kernel package to version v4.9.311 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system that provides core functionality and acts as an interface between the hardware and software layers.
The nfc (Near Field Communication) subsystem enables communication between devices in close proximity.
The nci (NFC Controller Interface) module is a part of the nfc subsystem and handles low-level communication with NFC controllers.
A use-after-free vulnerability occurs when a program continues to use a pointer to a memory object after it has been deallocated, leading to potential security issues.
An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
