CVE-2024-50268

usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

State: Published
Severity: 7.8 High
Published: Nov 19, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30).

The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control()

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	170a6726d0e266f2c8f306e3d61715c32f4ee41e to before d76923164705821aa1b01b8d9d1741f20c654ab4Affected 170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 8f47984b35f3be0cfc652c2ca358d5768ea3456bAffected 170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 604314ecd682913925980dc955caea2d036eab5fAffected 170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 69e19774f15e12dda6c6c58001d059e30895009bAffected 170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 3a2ba841659a0f15102585120dea75d8d5209616Affected 170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 7dd08a0b4193087976db6b3ee7807de7e8316f96Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

170a6726d0e266f2c8f306e3d61715c32f4ee41e to before d76923164705821aa1b01b8d9d1741f20c654ab4Affected
170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 8f47984b35f3be0cfc652c2ca358d5768ea3456bAffected
170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 604314ecd682913925980dc955caea2d036eab5fAffected
170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 69e19774f15e12dda6c6c58001d059e30895009bAffected
170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 3a2ba841659a0f15102585120dea75d8d5209616Affected
170a6726d0e266f2c8f306e3d61715c32f4ee41e to before 7dd08a0b4193087976db6b3ee7807de7e8316f96Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.