title: net/nfc: fix use-after-free llcp_sock_bind/connect
description: In the Linux kernel, the following vulnerability has been resolved:
net/nfc: fix use-after-free llcp_sock_bind/connect
Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()")
and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
fixed a refcount leak bug in bind/connect but introduced a
use-after-free if the same local is assigned to 2 different sockets.
This can be triggered by the following simple program:
int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) );
addr.sa_family = AF_NFC;
addr.nfc_protocol = NFC_PROTO_NFC_DEP;
bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
close(sock1);
close(sock2);
Fix this by assigning NULL to llcp_sock->local after calling
nfc_llcp_local_put.
This addresses CVE-2021-23134.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: a1cdd18c49d2, lessThan: 26157c82ba75, status: affected, versionType: git
version: 18013007b596, lessThan: ccddad6dd285, status: affected, versionType: git
version: 538a6ff11516, lessThan: 18ae4a192a44, status: affected, versionType: git
version: adbb1d218c5f, lessThan: 48fba458fe54, status: affected, versionType: git
version: c89903c9eff2, lessThan: e32352070bca, status: affected, versionType: git
version: 6fb003e5ae18, lessThan: 6b7021ed36da, status: affected, versionType: git
version: 8c9e4971e142, lessThan: 374cdde4dcc9, status: affected, versionType: git
version: c33b1cc62ac0, lessThan: 18175fe17ae0, status: affected, versionType: git
version: c33b1cc62ac0, lessThan: c61760e6940d, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.12, status: affected
version: 0, lessThan: 5.12, status: unaffected, versionType: custom
version: 4.4.269, lessThanOrEqual: 4.4.*, status: unaffected, versionType: custom
version: 4.9.269, lessThanOrEqual: 4.9.*, status: unaffected, versionType: custom
version: 4.14.233, lessThanOrEqual: 4.14.*, status: unaffected, versionType: custom
version: 4.19.191, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.119, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.37, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.11.21, lessThanOrEqual: 5.11.*, status: unaffected, versionType: custom
version: 5.12.4, lessThanOrEqual: 5.12.*, status: unaffected, versionType: custom
version: 5.13, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
