In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and
then dereferenced the cached pointer inside the locked region.
llcp_sock_bind() assigns and clears llcp_sock->local under the same
socket lock, dropping the last reference on its error path. A
getsockopt() racing an in-flight bind() can observe the pointer, block
on lock_sock(), and then dereference a freed nfc_llcp_local once bind()
has unwound.
Move the llcp_sock->local read and the NULL check inside the
lock_sock(sk) region so bind() cannot mutate or free the pointer between
the load and the use.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76
416baaa9-dc9f-4396-8d5f-8c081fb06d67