CVE-2024-46676 nfc: pn533: Add poll mod list filling check
A local attacker can cause a kernel crash via division by zero in the pn533 NFC driver by sending specific Netlink messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46676?
CVE-2024-46676 is a medium-severity denial of service vulnerability in Linux kernel, published on 13 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: Add poll mod list filling check
In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero.
Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll()
Add poll mod list filling check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Weakness: CWE-369
Which versions are affected by CVE-2024-46676?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46676?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-46676 being exploited?
There is no known exploitation of CVE-2024-46676 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49582, BELL-CVE-2024-46676, DEBIAN-CVE-2024-46676, GHSA-crwg-8vm3-26rf, UBUNTU-CVE-2024-46676.