Thunderbolt Zero-Length Property Entry Validation Flaw

Executive Summary

This vulnerability exists in the Linux kernel's Thunderbolt subsystem where the function tb_property_entry_valid() incorrectly accepts property entries with a length of zero for certain types (DIRECTORY, DATA, and TEXT). Specifically, a zero-length TEXT entry passes validation but leads to an underflow in the null-termination logic, causing the code to write to an invalid memory location (offset -1 relative to the allocation). This happens because the code attempts to set a null terminator at a position calculated as property->length * 4 - 1, which is invalid when length is zero.

The fix involves rejecting zero-length entries early in the validation process since such entries have no valid representation in the XDomain property protocol.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption due to an out-of-bounds write caused by the underflow in the null-termination logic when processing zero-length TEXT property entries. Such memory corruption could potentially be exploited to cause system instability, crashes, or even arbitrary code execution depending on the context and attacker capabilities.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by rejecting zero-length property entries in the Thunderbolt validator within the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Since the issue involves the tb_property_entry_valid() function accepting zero-length entries that cause an underflow, ensuring your system runs the patched kernel version will prevent exploitation.

Useful 0 Not Useful 0