CVE-2024-27060

What it actually does

NULL pointer dereference in tb_port_do_update_credits when a Thunderbolt 1 device with a single lane adapter is connected, triggered during hotplug and link attribute updates in the kernel thunderbolt driver.

Why it matters to the business

Unexpected system crashes and reboots occur when users connect certain older Thunderbolt 1 hardware, causing loss of work, disrupted operations, and potential data loss until the system is restarted or updated.

How an attack unfolds

An attacker with physical access connects a Thunderbolt 1 device that exposes only one lane adapter; the kernel hotplug path invokes tb_switch_update_link_attributes which calls the vulnerable credit update routine without checking for the second lane, resulting in a NULL dereference and kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 440fba897c5ae32d7df1f1d609dbb19e2bba7fbb or later; rebuild and reboot with the patched kernel, or apply the equivalent backport for the distribution in use.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the affected versions; reproduce by connecting a single-lane Thunderbolt 1 device and confirm absence of the NULL dereference panic in dmesg.

Typical attack path

1. Attacker gains physical access to a system with the vulnerable thunderbolt driver
2. Attacker plugs in a Thunderbolt 1 device limited to a single lane adapter
3. Kernel hotplug worker thread processes the device addition
4. tb_scan_port and tb_switch_add invoke link attribute and credit update paths
5. tb_port_do_update_credits dereferences a NULL pointer for the absent lane
6. Kernel oops and panic cause immediate system crash

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops traces containing tb_port_do_update_credits, tb_switch_update_link_attributes, or page_fault_oops during hotplug; look for crash signatures involving the thunderbolt module on device insertion.

• tb_port_do_update_credits+0x1b/0x130
• BUG: kernel NULL pointer dereference.*thunderbolt
• tb_switch_update_link_attributes
• tb_handle_hotplug

What your security team should do

• Apply the kernel update containing commit 440fba897c5ae32d7df1f1d609dbb19e2bba7fbb as soon as possible on all affected systems
• Restrict physical access to Thunderbolt ports until patches are deployed
• Monitor kernel logs for thunderbolt-related oops messages during device hotplug events
• Test the fix in a lab environment with representative Thunderbolt 1 hardware before broad rollout