Executive Summary

This vulnerability exists in the Linux kernel's Thunderbolt subsystem. Specifically, the function tb_xdomain_copy() copies a number of bytes equal to the expected response size from a received packet buffer without verifying the actual size of the frame. If a shorter response is received, this causes the function to read beyond the valid data into stale or leftover data from previous transactions in the DMA pool buffer.

The fix involves limiting the copy operation to the minimum of the actual frame size and the expected response size, preventing reading beyond the valid data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to reading stale or unintended data from memory buffers, which may cause information leakage or data corruption. Accessing data beyond the valid frame size can expose sensitive information from previous transactions or cause instability in the system.

Useful 0 Not Useful 0