CVE-2022-1975 in Linux
Summary
by MITRE • 08/31/2022
There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2022
The vulnerability identified as CVE-2022-1975 represents a critical sleep-in-atomic bug located within the NFC subsystem of the Linux kernel, specifically in the /net/nfc/netlink.c file. This flaw arises from improper handling of atomic contexts where the kernel code attempts to sleep while holding atomic locks or within atomic execution contexts. The issue manifests when user-space applications simulate NFC devices through netlink sockets, creating a scenario where kernel memory corruption can occur due to the violation of atomic execution principles. Such bugs are particularly dangerous because they can lead to complete system crashes or denial of service conditions that affect the entire operating environment.
The technical implementation of this vulnerability stems from the kernel's NFC netlink subsystem not properly validating or handling sleep operations within atomic contexts. When user-space applications create simulated NFC devices using netlink communication, the kernel code path that processes these requests fails to account for atomic execution requirements. This creates a race condition where the kernel attempts to sleep while in an atomic context, leading to kernel panic or system instability. The flaw is categorized under CWE-367, which specifically addresses Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities and improper handling of atomic operations. According to the ATT&CK framework, this vulnerability maps to T1499.004, which covers Network Denial of Service, as the attack can result in complete system unresponsiveness.
The operational impact of CVE-2022-1975 extends beyond simple system crashes, as it can be exploited to cause persistent denial of service conditions that affect NFC-enabled devices and systems. Mobile devices, IoT appliances, and embedded systems that rely on NFC functionality become vulnerable to this attack vector, potentially leading to complete service interruption. The vulnerability is particularly concerning in environments where NFC is used for critical operations such as payment processing, access control, or industrial automation systems. Attackers can exploit this weakness by crafting malicious user-space applications that simulate NFC devices and trigger the kernel sleep operation within atomic contexts, resulting in system instability that can be difficult to diagnose and recover from without manual intervention.
Mitigation strategies for CVE-2022-1975 require immediate kernel updates from vendors, as the flaw exists at the core kernel level and cannot be effectively addressed through user-space patches alone. System administrators should prioritize applying security patches from their respective Linux distributions, particularly those addressing the NFC subsystem in kernel versions 5.17 and earlier. Additional protective measures include implementing strict user-space access controls for NFC device simulation capabilities, monitoring for unusual netlink socket activity, and disabling unnecessary NFC functionality on systems where it is not required. The vulnerability demonstrates the importance of proper atomic context management in kernel code development and highlights the need for comprehensive testing of atomic operations within kernel subsystems. Organizations should also consider implementing network segmentation to limit potential attack vectors and establish incident response procedures specifically addressing kernel-level vulnerabilities that can cause system-wide crashes.