Riskcovery

CVE-2024-35924

usb: typec: ucsi: Limit read size on v1.2

State
Published
Severity
7.1 High
Published
May 19, 2024
Updated
Oct 30, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI version to truncate read sizes on UCSI v1.2.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before af9bdf05557dc21040df2f11062133dd1e503a09Affected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before 266f403ec47573046dee4bcebda82777ce702c40Affected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before 0defcaa09d3b21e8387829ee3a652c43fa91e13fAffected
  • bdc62f2bae8fb0e8e99574de5232f0a3c54a27df to before b3db266fb031fba88c423d4bb8983a73a3db6527Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.27 through 6.6.*Not affected
  • 6.8.6 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.