Linux Kernel Thunderbolt Property Recursion Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the Linux kernel's Thunderbolt property handling. The issue arises in the 'property' parser, where a DIRECTORY entry's value is used as the directory offset for recursive calls into the parsing function, '__tb_property_parse_dir()', without any depth counter. This flaw allows a malicious peer to create a back-referencing loop by chaining DIRECTORY entries, causing the parser to recursively process the entries until the kernel stack is exhausted and the guard page is triggered. This vulnerability can be exploited by any untrusted XDomain peer, such as a cable, dock, in-line inspector, or adjacent host, during the PROPERTIES_REQUEST control-plane exchange, and does not require authentication.

Impact

Exploitation of this vulnerability leads to a stack exhaustion, causing a denial-of-service condition where the system becomes unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by sending a crafted PROPERTIES_REQUEST control-plane exchange from an untrusted XDomain peer. The crafted request must include DIRECTORY entries that are chained into a back-referencing loop, which will drive the property parser into a recursive call that exhausts the kernel stack.

Remediation

The vulnerability has been fixed in the Linux kernel. Users can apply the latest patches available in the Linux kernel stable tree to address this issue. Instructions for downloading the patched version can be found in the Linux kernel repository.