CVE-2024-27060

thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()

published May 1, 2024

CVSS
—
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()

Olliver reported that his system crashes when plugging in Thunderbolt 1

device:

BUG: kernel NULL pointer dereference, address: 0000000000000020

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP NOPTI

RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt]

Call Trace:

<TASK>

? __die+0x23/0x70

? page_fault_oops+0x171/0x4e0

? exc_page_fault+0x7f/0x180

? asm_exc_page_fault+0x26/0x30

? tb_port_do_update_credits+0x1b/0x130

? tb_switch_update_link_attributes+0x83/0xd0

tb_switch_add+0x7a2/0xfe0

tb_scan_port+0x236/0x6f0

tb_handle_hotplug+0x6db/0x900

process_one_work+0x171/0x340

worker_thread+0x27b/0x3a0

? __pfx_worker_thread+0x10/0x10

kthread+0xe5/0x120

? __pfx_kthread+0x10/0x10

ret_from_fork+0x31/0x50

? __pfx_kthread+0x10/0x10

ret_from_fork_asm+0x1b/0x30

</TASK>

This is due the fact that some Thunderbolt 1 devices only have one lane

adapter. Fix this by checking for the lane 1 before we read its credits.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2024-05-01T13:00Z
EPSS history
Timeline
  • 01 MAY 13:00Z
    thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
    cvelistv5