Linux Kernel Slab Out-of-Bounds Read in NFC LLCP

Executive Summary

This vulnerability in the Linux kernel involves slab-out-of-bounds reads when logging service names in the NFC LLCP module. The issue occurs because non-null-terminated strings are passed to pr_debug() using the %s format specifier. Buffers allocated via kmemdup() or from netlink attributes may not be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated memory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves slab-out-of-bounds reads in the Linux kernel's NFC LLCP module. Detection requires checking kernel logs for KASAN errors or slab-out-of-bounds warnings. Use dmesg | grep -i kasan or dmesg | grep -i slab-out-of-bounds to search for related errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to read sensitive kernel memory, potentially leading to information disclosure or privilege escalation. It may cause system instability or crashes due to memory corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves slab-out-of-bounds reads due to improper string handling in the Linux kernel's NFC LLCP module. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. The issue is limited to debug logging and does not expose or modify sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the kernel patch that fixes the issue in nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() by using %.*s with explicit string lengths. Update to a patched kernel version or backport the fix if using a custom kernel.

Useful 0 Not Useful 0