Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < c55da494dfb445fb28df3a9d293c2be6a299cd01affectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 7720654b4842bcdfeb64bc002f6186041849e1e7affectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 033dfa63bf6be2653441a1dccae4a8313a91bb9daffectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < fc261397295b8ad0654cec747b0ec25ea0011995affectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cbaffectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < b5daa920f44cb582272fc9bfaeb67408776cbaefaffectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4affectedcdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8ebaffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c55da494dfb445fb28df3a9d293c2be6a299cd01 ↗
- https://git.kernel.org/stable/c/7720654b4842bcdfeb64bc002f6186041849e1e7 ↗
- https://git.kernel.org/stable/c/033dfa63bf6be2653441a1dccae4a8313a91bb9d ↗
- https://git.kernel.org/stable/c/fc261397295b8ad0654cec747b0ec25ea0011995 ↗
- https://git.kernel.org/stable/c/a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb ↗
- https://git.kernel.org/stable/c/b5daa920f44cb582272fc9bfaeb67408776cbaef ↗
- https://git.kernel.org/stable/c/b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4 ↗
- https://git.kernel.org/stable/c/4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗