In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.8
Impact Score: 5.2
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-125
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e7700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341ef9280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b89fd00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c40a8c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e4a80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c4e5740> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd360439f80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd34088c7c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd38418cb00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c4e6c80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd341268f00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd37039dbc0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |