CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid()
entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > blocklen check. tbpropertyparse() then passes entry->value to parsedwdata() as a dword offset into the property block, reading attacker-directed memory far past the allocation.
For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->devicename / xd->vendorname and is readable back via the per-XDomain devicename / vendorname sysfs attributes; the leak is NUL-bounded (kstrdup() stops at the first zero byte) and untargeted (the attacker picks a delta, not an absolute address). DATA-typed entries are parsed into property->value.data but not generically surfaced to userspace.
Use checkaddoverflow() so a wrapped sum is rejected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to control a malicious XDomain peer reachable over Thunderbolt. No local privileges or user interaction are required according to the CVSS vector.
What information can be exposed through this flaw?
TEXT property entries using the "deviceid" or "vendorid" keys can cause data beyond the property-block allocation to be copied into the per-XDomain device_name or vendor_name fields and read through their sysfs attributes. The disclosure is limited by the first NUL byte and the attacker can select an offset delta rather than an absolute target address.
Are all malformed property types exposed through sysfs?
No. DATA-typed entries can also be parsed using the invalid offset, but their resulting property data is not generically surfaced to userspace.
How is the vulnerable input rejected by the fix?
The fix uses check_add_overflow() when adding the u32 value and u16 length, rejecting entries whose sum would wrap instead of allowing the wrapped value to pass the property-block bounds check.