CVE-2024-50227

What it actually does

Stack out-of-bounds read in tb_retimer_scan() caused by loop variable increment making max=3 instead of 2, allowing the second loop to read past a stack-declared array during Thunderbolt retimer scanning in the hotplug workqueue.

Why it matters to the business

Kernel crashes or limited memory disclosure on systems with Thunderbolt hardware during hotplug events; delayed patching increases exposure window for Linux environments with high device connectivity.

How an attack unfolds

An attacker triggers a Thunderbolt hotplug event (physical port access or malicious device) to invoke tb_handle_hotplug, which calls tb_scan_port and then tb_retimer_scan; the off-by-one loop reads past the stack array, surfacing via KASAN in the kworker thread.

How to fix it

Update the Linux kernel to include commit 08b2771e9270fbe1ed4fbbe93abe05ac7fe9861d or apply the equivalent stable backport; rebuild and reboot with the fixed thunderbolt module.

How to confirm the fix worked

Verify the kernel source contains the direct assignment to max inside the loop body; confirm absence of the KASAN stack-out-of-bounds report in tb_retimer_scan after hotplug testing; check dmesg for the resolved call trace.

Typical attack path

1. Obtain physical or logical access to a Thunderbolt port
2. Insert or emulate a device that triggers hotplug processing
3. tb_handle_hotplug workqueue invokes tb_retimer_scan with malformed retimer data
4. Off-by-one loop performs out-of-bounds stack read
5. KASAN report or kernel panic occurs; potential for controlled read in advanced scenarios

How to detect it

Search kernel logs and dmesg for KASAN reports containing tb_retimer_scan+0xffe, stack-out-of-bounds reads during thunderbolt hotplug workqueue activity, or the exact call trace involving tb_scan_port and tb_handle_hotplug.

• tb_retimer_scan+0xffe/0x1550 [thunderbolt]
• BUG: KASAN: stack-out-of-bounds in tb_retimer_scan
• Read of size 4 at addr ffff88810111fc1c by task kworker
• Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt]

What your security team should do

• Prioritize kernel update on all systems exposing Thunderbolt ports
• Monitor vendor advisories for distribution-specific packages containing the 08b2771e9270 commit
• Restrict physical Thunderbolt access until patches are deployed
• Enable KASAN or similar kernel sanitizers in test environments to validate the fix