This is an automated email from the ASF dual-hosted git repository.
michallenc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new a3029acf959 drivers/contactless/mfrc522: Contactless Driver Is Not
Robust
a3029acf959 is described below
commit a3029acf9598f40f0d3620bb2bf71503b59af63b
Author: Catalin Visinescu <[email protected]>
AuthorDate: Wed Jul 1 23:00:35 2026 -0400
drivers/contactless/mfrc522: Contactless Driver Is Not Robust
An attacker can specify an arbitrary page address when reading MIFARE tags.
Without validation, this could read beyond intended memory regions on the
tag, potentially causing a crash.
The mfrc522_mifare_read() command is also not robust and does not check
that the page address is valid. From section 7.6.5 of the *MIFARE Ultralight
contactless single-ticket IC
(https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf) document:
>> The READ command needs the page address as a parameter. Only addresses
00h to 0Fh are decoded.
Testing: Builds fine.
Signed-off-by: Catalin Visinescu <[email protected]>
---
drivers/contactless/mfrc522.c | 8 ++++++++
drivers/contactless/pn532.c | 14 ++++++++++++++
2 files changed, 22 insertions(+)
diff --git a/drivers/contactless/mfrc522.c b/drivers/contactless/mfrc522.c
index 2f745382581..db03cc79004 100644
--- a/drivers/contactless/mfrc522.c
+++ b/drivers/contactless/mfrc522.c
@@ -1221,6 +1221,14 @@ int mfrc522_mifare_read(FAR struct mfrc522_dev_s *dev,
uint8_t validbits = 0;
int ret = OK;
+ /* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
+
+ if (data->address > 15)
+ {
+ ret = -ERANGE;
+ goto errout;
+ }
+
/* Read block from address */
command[0] = PICC_CMD_MF_READ;
diff --git a/drivers/contactless/pn532.c b/drivers/contactless/pn532.c
index 7fea654be86..88e631bd9ef 100644
--- a/drivers/contactless/pn532.c
+++ b/drivers/contactless/pn532.c
@@ -637,6 +637,13 @@ uint32_t pn532_write_passive_data(FAR struct pn532_dev_s
*dev,
uint8_t resp[20];
uint32_t res = -EIO;
+ /* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
+
+ if (address > 15)
+ {
+ return -ERANGE;
+ }
+
pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
f->data[1] = 1; /* max n cards at once */
f->data[2] = 0xa2; /* command WRITE */
@@ -677,6 +684,13 @@ uint32_t pn532_read_passive_data(FAR struct pn532_dev_s
*dev,
uint8_t resp[30];
uint32_t res = -1;
+ /* Validate against expected tag size */
+
+ if (address > 15)
+ {
+ return -ERANGE;
+ }
+
pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
f->data[1] = 1; /* max n cards at once */
f->data[2] = 0x30; /* command READ */
