CVE-2021-3760
📋 TL;DR
CVE-2021-3760 is a use-after-free vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem. This flaw allows local attackers to potentially execute arbitrary code, escalate privileges, or crash the system by exploiting improper memory handling. It affects Linux systems with NFC hardware or drivers enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, complete system compromise, or kernel panic causing denial of service.
Likely Case
Local privilege escalation allowing attackers to gain root access on affected systems.
If Mitigated
Limited impact if NFC functionality is disabled or systems are properly segmented.
🎯 Exploit Status
Requires local access and knowledge of kernel exploitation techniques. Proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.14-rc1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2000585
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.14-rc1 or later. 2. For distributions: Apply vendor patches (e.g., 'yum update kernel' for RHEL, 'apt update && apt upgrade' for Debian). 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable NFC subsystem
linuxRemove or blacklist NFC kernel modules to prevent exploitation
modprobe -r nfc
echo 'blacklist nfc' >> /etc/modprobe.d/blacklist-nfc.conf
🧯 If You Can't Patch
- Disable NFC functionality if not required
- Implement strict access controls to limit local user privileges
🔍 How to Verify
Check if Vulnerable:
Check kernel version: 'uname -r' and compare with affected versions. Check if NFC modules are loaded: 'lsmod | grep nfc'Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.14-rc1 or later: 'uname -r'. Check for applied patches via distribution-specific commands.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to NFC
- Unexpected kernel module loading/unloading
- Privilege escalation attempts
Network Indicators:
- N/A - local exploitation only
SIEM Query:
source="kernel" AND ("nfc" OR "use-after-free")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=2000585
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20220318-0007/
- https://www.debian.org/security/2022/dsa-5096
- https://bugzilla.redhat.com/show_bug.cgi?id=2000585
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20220318-0007/
- https://www.debian.org/security/2022/dsa-5096
