In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()<\/p>\n
entry->value is u32 and entry->length is u16; the sum is performed in
\nu32 and wraps. A malicious XDomain peer can pick
\nvalue = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0
\nand passes the > block_len check. tb_property_parse() then passes
\nentry->value to parse_dwdata() as a dword offset into the property
\nblock, reading attacker-directed memory far past the allocation.<\/p>\n
For TEXT-typed entries with the “deviceid” or “vendorid” keys this
\nlands in xd->device_name \/ xd->vendor_name and is readable back via
\nthe per-XDomain device_name \/ vendor_name sysfs attributes; the leak
\nis NUL-bounded (kstrdup() stops at the first zero byte) and
\nuntargeted (the attacker picks a delta, not an absolute address).
\nDATA-typed entries are parsed into property->value.data but not
\ngenerically surfaced to userspace.<\/p>\n
Use check_add_overflow() so a wrapped sum is rejected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()<\/p>\n
entry->value is u32 and entry->length is u16; the sum is perfo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14944","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}