Use-after-free Vulnerability in Linux Kernel's NFC Subsystem by Vendor Linux

CVE-2023-53023

What is CVE-2023-53023?

The Linux kernel's NFC subsystem contains a use-after-free vulnerability caused by improper management of memory during the device detachment process. Specifically, when an NFC device is detached, the local_cleanup() function can be called multiple times, leading to deallocation of memory that has already been freed. This is triggered by the transition of the NFC daemon states, particularly when the daemon releases sockets alongside device resources. The flaw can result in significant security risks, as it may allow attackers to exploit the memory corruption, potentially leading to unpredictable behavior in the kernel.

References