In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-191
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a014600> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd38557df00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd51320aa80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2d8110480> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd38557dfc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd38557c940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a76cc00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a76c4c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a76edc0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd38557f140> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a76d440> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd369a313c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a76eb00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36b2596c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |