NetSight
IP …
high7.8

CVE-2024-50268

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" var…

Impact

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control()

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.6 before 5.10.230
from 5.11 before 5.15.172
from 5.16 before 6.1.117
from 6.2 before 6.6.61
from 6.7 before 6.11.8
Version 6.12

Weakness classification

CWE-125

References