CVE-2023-52502

What it actually does

Race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() allows use-after-free by releasing lock before taking a reference on the looked-up socket; nfc_llcp_recv_snl() has a similar exposure via nfc_llcp_sock_from_sn().

Why it matters to the business

Affected Linux kernels with NFC support risk denial of service or remote code execution on devices and servers, potentially disrupting operations until patched.

How an attack unfolds

An attacker triggers concurrent NFC LLCP socket lookups while holding and releasing locks to free a socket structure that is later dereferenced, achieving use-after-free; threat actor references include Android kernel RCE scenarios that could leverage similar memory corruption.

How to fix it

Apply the fix commit e863f5720a5680e50c4cecf12424d7cc31b3eb0a in the Linux kernel stable tree; rebuild and deploy updated kernels containing the corrected reference handling in LLCP socket functions.

How to confirm the fix worked

Confirm the patch is present by checking for the commit in kernel sources; exercise nfc_llcp_sock_get(), nfc_llcp_sock_get_sn(), and nfc_llcp_recv_snl() under concurrent load to verify absence of UAF.

Typical attack path

1. Enable or trigger NFC LLCP traffic on a vulnerable kernel
2. Race nfc_llcp_sock_get() or nfc_llcp_sock_get_sn() with socket teardown
3. Trigger use-after-free via nfc_llcp_recv_snl() to corrupt kernel memory
4. Escalate to code execution or kernel panic

How to detect it

Inspect kernel logs for NFC LLCP related oops, warnings, or use-after-free reports; correlate socket creation/teardown events with NFC traffic spikes.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems
• Disable NFC/LLCP interfaces where not required until patched
• Review downstream kernel distributions for backported fixes