CyberRota Analysis
AI-GeneratedA vulnerability in the Linux kernel's Thunderbolt implementation allows an untrusted XDomain peer to exploit a lack of recursion depth control in the property parsing function, potentially leading to a kernel stack exhaustion and system crash. This issue can be triggered without authentication by malicious devices connected via Thunderbolt, making it critical for organizations using affected Linux systems with Thunderbolt interfaces to prioritize remediation. Operators can mitigate the risk by disabling XDomain host-to-host discovery if it is not needed.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.