CVE-2024-50227: thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan()
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix KASAN reported stack out-of-bounds read in tbretimerscan()
KASAN reported following issue:
BUG: KASAN: stack-out-of-bounds in tbretimerscan+0xffe/0x1550 [thunderbolt] Read of size 4 at addr ffff88810111fc1c by task kworker/u56:0/11 CPU: 0 UID: 0 PID: 11 Comm: kworker/u56:0 Tainted: G U 6.11.0+ #1387 Tainted: [U]=USER Workqueue: thunderbolt0 tbhandlehotplug [thunderbolt] Call Trace: <TASK> dumpstacklvl+0x6c/0x90 printreport+0xd1/0x630 kasanreport+0xdb/0x110 asanreportload4noabort+0x14/0x20 tbretimerscan+0xffe/0x1550 [thunderbolt] tbscanport+0xa6f/0x2060 [thunderbolt] tbhandlehotplug+0x17b1/0x3080 [thunderbolt] processonework+0x626/0x1100 workerthread+0x6c8/0xfa0 kthread+0x2c8/0x3a0 retfromfork+0x3a/0x80 retfromforkasm+0x1a/0x30
This happens because the loop variable still gets incremented by one so max becomes 3 instead of 2, and this makes the second loop read past the the array declared on the stack.
Fix this by assigning to max directly in the loop body.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50227?
CVE-2024-50227 has been classified as a vulnerability affecting the Linux kernel that could lead to stack out-of-bounds read issues.
How do I fix CVE-2024-50227?
To fix CVE-2024-50227, update your Linux kernel to version 6.11.7 or later, including all the specified 6.12 release candidates.
Which versions of the Linux kernel are affected by CVE-2024-50227?
CVE-2024-50227 affects Linux kernel versions from 6.11 to 6.12-rc5.
What component of the Linux kernel is affected by CVE-2024-50227?
CVE-2024-50227 specifically affects the Thunderbolt component within the Linux kernel.
What does CVE-2024-50227 imply for system integrity?
CVE-2024-50227 could potentially lead to security risks associated with memory corruption due to out-of-bounds reads.