CVE-2024-46676

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Add poll mod list filling check

In case of im_protocols value is 1 and tm_protocols value is 0 this

combination successfully passes the check

'if (!im_protocols && !tm_protocols)' in the nfc_start_poll().

But then after pn533_poll_create_mod_list() call in pn533_start_poll()

poll mod list will remain empty and dev->poll_mod_count will remain 0

which lead to division by zero.

Normally no im protocol has value 1 in the mask, so this combination is

not expected by driver. But these protocol values actually come from

userspace via Netlink interface (NFC_CMD_START_POLL operation). So a

broken or malicious program may pass a message containing a "bad"

combination of protocol parameter values so that dev->poll_mod_count

is not incremented inside pn533_poll_create_mod_list(), thus leading

to division by zero.

Call trace looks like:

nfc_genl_start_poll()

nfc_start_poll()

->start_poll()

pn533_start_poll(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References