Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/contactless/mfrc522: Contactless Driver Is Not Robust

Browse source 
An attacker can specify an arbitrary page address when reading MIFARE tags.
Without validation, this could read beyond intended memory regions on the
tag, potentially causing a crash.

The mfrc522_mifare_read() command is also not robust and does not check
that the page address is valid. From section 7.6.5 of the *MIFARE Ultralight
contactless single-ticket IC
(https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf) document:

>> The READ command needs the page address as a parameter. Only addresses
00h to 0Fh are decoded.

Testing: Builds fine.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-07-01 23:00:35 -04:00 • committed by Michal Lenc
parent 5b52752835
commit a3029acf95
2 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/contactless/mfrc522.c
View file

@ -1221,6 +1221,14 @@ int mfrc522_mifare_read(FAR struct mfrc522_dev_s *dev,
uint8_t validbits = 0;
int ret = OK;
/* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
if (data->address > 15)
{
ret = -ERANGE;
goto errout;
}
/* Read block from address */
command[0] = PICC_CMD_MF_READ;

14
drivers/contactless/pn532.c
View file

@ -637,6 +637,13 @@ uint32_t pn532_write_passive_data(FAR struct pn532_dev_s *dev,
uint8_t resp[20];
uint32_t res = -EIO;
/* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
if (address > 15)
{
return -ERANGE;
}
pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
f->data[1] = 1; /* max n cards at once */
f->data[2] = 0xa2; /* command WRITE */
@ -677,6 +684,13 @@ uint32_t pn532_read_passive_data(FAR struct pn532_dev_s *dev,
uint8_t resp[30];
uint32_t res = -1;
/* Validate against expected tag size */
if (address > 15)
{
return -ERANGE;
}
pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
f->data[1] = 1; /* max n cards at once */
f->data[2] = 0x30; /* command READ */