CVE-2024-46676

What it actually does

Division by zero in pn533_start_poll() when pn533_poll_create_mod_list() leaves dev->poll_mod_count at zero after nfc_start_poll() accepts im_protocols=1 and tm_protocols=0 from userspace Netlink.

Why it matters to the business

Local denial-of-service on Linux systems using the pn533 NFC driver; kernel panic or crash can disrupt operations on affected devices. Low ecosystem prevalence for this specific NFC path.

How an attack unfolds

A local process invokes NFC_CMD_START_POLL over Netlink with an unexpected protocol mask; the driver passes the malformed values through nfc_start_poll() into pn533_start_poll(), the poll-mod list stays empty, poll_mod_count remains zero, and a later division triggers a kernel crash. No named threat actors are tied to this specific flaw.

How to fix it

Upgrade the Linux kernel to commit c5e05237444f32f6cfe5d907603a232c77a08b31 or later stable release containing the poll-mod-list check. Reboot after applying the update.

How to confirm the fix worked

Confirm the running kernel contains commit c5e05237444f32f6cfe5d907603a232c77a08b31; attempt to reproduce the division-by-zero condition with a test program sending the bad protocol combination and verify the kernel no longer panics.

Typical attack path

1. Obtain local unprivileged access on a system with pn533 NFC support
2. Craft and send NFC_CMD_START_POLL Netlink message containing im_protocols=1, tm_protocols=0
3. Trigger nfc_genl_start_poll() -> nfc_start_poll() -> pn533_start_poll() path
4. Cause division by zero when poll_mod_count is used as divisor

How to detect it

Review kernel logs for oops/panic traces referencing nfc_genl_start_poll, nfc_start_poll, pn533_start_poll, or division by zero in pn533_poll_create_mod_list; inspect audit logs for unusual Netlink NFC_CMD_START_POLL messages from non-root processes.

• nfc_genl_start_poll
• pn533_start_poll
• poll_mod_count
• NFC_CMD_START_POLL

What your security team should do

• Apply the kernel update containing c5e05237444f32f6cfe5d907603a232c77a08b31 as soon as possible
• Restrict untrusted local users from accessing the NFC Netlink interface via AppArmor or SELinux policy
• Monitor for kernel oops or panic logs containing pn533_start_poll and nfc_start_poll symbols