Thunderbolt NULL Pointer Dereference Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-27060: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BU... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software and hardware, ensuring efficient operation of the system. This vulnerability specifically affects the Thunderbolt functionality within the Linux kernel, which is designed to manage Thunderbolt devices, allowing for high-speed data transfer and connectivity. The vulnerability arises from a failure to properly check for the existence of a lane in certain Thunderbolt 1 devices, leading to potential system crashes.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-27060 is a NULL pointer dereference issue in the Linux kernel's Thunderbolt implementation. It occurs when a Thunderbolt 1 device with a single lane adapter is connected, causing the system to crash due to an attempt to access a non-existent memory address. This can lead to a kernel panic, resulting in a denial of service as the system becomes unresponsive. The technical details indicate that the issue arises in the tb_port_update_credits function, where the absence of a proper check for lane existence leads to the dereference of a NULL pointer.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid connecting Thunderbolt 1 devices until the system has been updated to the patched version. Additionally, users may consider disabling Thunderbolt support in the BIOS/UEFI settings if immediate use of these devices is not critical.
Conclusion
The Thunderbolt NULL pointer dereference vulnerability in the Linux package poses a significant risk to systems utilizing Thunderbolt 1 devices. It is crucial for users to update their systems to the patched version to avoid potential crashes and ensure system stability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been allocated, leading to crashes or unexpected behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary consequence is a system crash or kernel panic when a vulnerable Thunderbolt device is connected, leading to potential data loss and service interruption.
Yes, temporarily avoiding the use of Thunderbolt 1 devices or disabling Thunderbolt support in BIOS/UEFI can mitigate the risk until an update is applied.
Detailed information can be found in the Debian security advisories or by visiting the Vulert website, which provides insights into open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
