Description
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
dfccd0f580445d176acea174175b3e6518cc91f7 to < c5e05237444f32f6cfe5d907603a232c77a08b31affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < 8ddaea033de051ed61b39f6b69ad54a411172b33affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < 7535db0624a2dede374c42040808ad9a9101d723affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < 7ecd3dd4f8eecd3309432156ccfe24768e009ec4affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < 56ad559cf6d87f250a8d203b555dfc3716afa946affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < 64513d0e546a1f19e390f7e5eba3872bfcbdacf5affecteddfccd0f580445d176acea174175b3e6518cc91f7 to < febccb39255f9df35527b88c953b2e0deae50e53affected
Linux Linux
Default version status: affected
3.12affected0 to < 3.12unaffected5.4.283 to ≤ 5.4.*unaffected5.10.225 to ≤ 5.10.*unaffected5.15.166 to ≤ 5.15.*unaffected6.1.108 to ≤ 6.1.*unaffected6.6.49 to ≤ 6.6.*unaffected6.10.8 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c5e05237444f32f6cfe5d907603a232c77a08b31 ↗
- https://git.kernel.org/stable/c/8ddaea033de051ed61b39f6b69ad54a411172b33 ↗
- https://git.kernel.org/stable/c/7535db0624a2dede374c42040808ad9a9101d723 ↗
- https://git.kernel.org/stable/c/7ecd3dd4f8eecd3309432156ccfe24768e009ec4 ↗
- https://git.kernel.org/stable/c/56ad559cf6d87f250a8d203b555dfc3716afa946 ↗
- https://git.kernel.org/stable/c/64513d0e546a1f19e390f7e5eba3872bfcbdacf5 ↗
- https://git.kernel.org/stable/c/febccb39255f9df35527b88c953b2e0deae50e53 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html ↗