Linux Kernel Thunderbolt Property Size Validation Vulnerability

A vulnerability in the Linux kernel's Thunderbolt property handling has been addressed. The issue involved improper validation of the 'dir_len' property, which could lead to a size_t underflow and out-of-bounds memory access. This vulnerability was present in the non-root path of the Thunderbolt driver, where the 'dir_len' was taken from an entry's length. If the length was less than 4, it could bypass validation and cause the UUID copy process to read beyond the intended memory block, potentially leading to kernel crashes or memory corruption.

Impact

Exploitation of this vulnerability could cause out-of-bounds memory access, leading to memory corruption or a kernel crash.

Reproduction

The vulnerability can be reproduced by creating a crafted Thunderbolt property entry with a 'dir_offset' close to the end of the property block and a 'dir_len' of 0 to 3. This entry will pass the initial validation but cause the UUID copy function to read beyond the allocated memory, triggering the out-of-bounds condition.

Remediation

The vulnerability has been fixed in the Linux kernel stable tree. Users can upgrade to the latest version to address this issue.