In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | LOW |
| Availability Impact | NONE |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.8
Impact Score: 4.2
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368e8a4c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36945ccc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3697d5300> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36945cac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368e896c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368e89700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a7ec7c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd34122da80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36945f180> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd368e8a340> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3855da2c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c4a7a00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3697d5b80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a7efd80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |