PT-2026-61210 · Linux · Linux
CVE-2026-63893
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.1
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Reject u32 wrap in tb property entry valid()
entry->value is u32 and entry->length is u16; the sum is performed in
u32 and wraps. A malicious XDomain peer can pick
value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0
and passes the > block len check. tb property parse() then passes
entry->value to parse dwdata() as a dword offset into the property
block, reading attacker-directed memory far past the allocation.
For TEXT-typed entries with the "deviceid" or "vendorid" keys this
lands in xd->device name / xd->vendor name and is readable back via
the per-XDomain device name / vendor name sysfs attributes; the leak
is NUL-bounded (kstrdup() stops at the first zero byte) and
untargeted (the attacker picks a delta, not an absolute address).
DATA-typed entries are parsed into property->value.data but not
generically surfaced to userspace.
Use check add overflow() so a wrapped sum is rejected.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux