CVE-2021-47612

What it actually does

Null pointer dereference in nfc_genl_dump_devices_done() when kmalloc fails inside nfc_genl_dump_devices(), resulting in KASAN null-ptr-deref during netlink socket destruction work.

Why it matters to the business

Kernel panic or system crash on affected Linux-based systems including certain Xen deployments, leading to denial of service and potential loss of availability for NFC-dependent services.

How an attack unfolds

An attacker with local access triggers NFC netlink dump operations that cause memory allocation failure, after which the error-handling path dereferences a null pointer during socket cleanup, crashing the kernel.

How to fix it

Upgrade affected Xen packages on Alpine v3.16 to version 4.16.5-r7 or later; apply the upstream Linux kernel patch that resolves the null dereference in nfc_genl_dump_devices_done().

How to confirm the fix worked

Confirm the package version is at least 4.16.5-r7 on Alpine Xen images; verify the nfc_genl_dump_devices_done function no longer calls class_dev_iter_exit on a potentially null iterator after a failed allocation.

Typical attack path

1. Obtain local access on a vulnerable kernel with NFC netlink enabled
2. Trigger nfc_genl_dump_devices() via crafted netlink messages
3. Force kmalloc failure inside the dump path
4. Cause nfc_genl_dump_devices_done() to execute the faulty klist_iter_exit path
5. Trigger kernel panic via null pointer dereference

How to detect it

Search kernel logs for KASAN null-ptr-deref reports mentioning klist_iter_exit or nfc_genl_dump_devices_done; look for netlink_sock_destruct_work in process_one_work traces on systems exposing NFC netlink.

What your security team should do

• Prioritize patching Xen/Alpine systems within 30 days given the kernel memory corruption class
• Disable NFC netlink interfaces if not required
• Monitor for kernel oops or KASAN reports referencing nfc_genl_dump_devices_done