Linux Kernel NFC LLCP Connection State Machine Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's NFC LLCP connection state machine. This issue arises from a race condition where the connection acceptance packet (CC) is processed simultaneously with the release of a socket. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, where a freed socket is incorrectly linked into a live list, potentially causing memory corruption or other unintended behavior.

Reproduction

The vulnerability can be reproduced by processing a connection acceptance packet (CC) in the NFC LLCP connection state machine while simultaneously releasing the associated socket. This can be achieved by moving the socket from the connecting_sockets list to the sockets list without holding the socket lock, allowing the socket release to unlink the socket and drop its references before the state transition is completed.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.