Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 0b334279a82d79fb4723bd4f614305de1ab69caa; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 6021d39ccd979713b39b980286020d8f9a45efd1; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 5db10c8ad8c09f72c847dfeef3d876098257f505; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 05a43157676c243c248d1c6d9dcecbe6eba2f35d; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before fcbd0cdab92838854a5818be7ed8a097164ef6d5; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 906035d5c3784570191d259cbf9a0ac1617852b5; affected cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 322e93448d908434ae5545660fcbe8f5a7a8e141 |
| Linux / Linux | affected 4.15; unaffected 0 before 4.15; unaffected 5.10.259 through 5.10.*; unaffected 5.15.210 through 5.15.*; unaffected 6.1.176 through 6.1.*; unaffected 6.6.143 through 6.6.*; unaffected 6.12.94 through 6.12.*; unaffected 6.18.36 through 6.18.*; unaffected 7.0.13 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa
- https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1
- https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d
- https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505
- https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d
- https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5
- https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5
- https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141
ADP enrichment
A flaw was found in the Linux kernel's Thunderbolt driver. A malicious peer can exploit this vulnerability by sending a specially crafted response that causes the system to write data beyond an allocated memory buffer. This out-of-bounds write can lead to memory corruption, which may allow an attacker to cause a denial of service or potentially execute arbitrary code.
No English description supplied.