{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50268", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.982Z", "datePublished": "2024-11-19T01:30:05.437Z", "dateUpdated": "2026-08-05T11:42:56.179Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:42:56.179Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()\n\nThe \"*cmd\" variable can be controlled by the user via debugfs. That means\n\"new_cam\" can be as high as 255 while the size of the uc->updated[] array\nis UCSI_MAX_ALTMODES (30).\n\nThe call tree is:\nucsi_cmd() // val comes from simple_attr_write_xsigned()\n-> ucsi_send_command()\n -> ucsi_send_command_common()\n -> ucsi_run_command() // calls ucsi->ops->sync_control()\n -> ucsi_ccg_sync_control()" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker-controlled `*cmd` value originates from a local write to the UCSI debugfs `command` file on the local system, not from any network or remote peer input. No physical access is required to issue the malformed command itself.\nAC:L - The index is taken verbatim from bits 24-31 of the value the attacker writes, so the out-of-bounds access is deterministic and repeatable with no race or memory-layout guessing. The `has_multiple_dp` precondition is under the attacker's own control since a local attacker can attach a Type-C partner advertising multiple DP alternate modes.\nPR:L - Reaching the code requires write access to the UCSI debugfs interface, which is an authenticated local account with access to the debugfs mount rather than any remote or unauthenticated position. Consistent with prior kernel.org scoring of debugfs-reachable overflows, this is treated as low privilege rather than high.\nUI:N - The attacker triggers the flaw entirely on their own by writing the crafted UCSI command; no separate victim needs to open a file, mount a filesystem, or take any other action. Establishing the multi-DP connector state is an action the attacker performs themselves, not a victim.\nS:U - The out-of-bounds access corrupts kernel heap memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `new_port->linked_idx` and `new_port->svid` are read from an attacker-selected offset ranging up to roughly 2 KB past the end of the `updated[]` array and past the containing `struct ucsi_ccg` allocation, so this is a wide-ranging heap out-of-bounds read rather than a tightly bounded one. The disclosed bytes steer subsequent control flow and the command value programmed into the PD controller, and such heap OOB reads are leverageable for broader kernel memory disclosure.\nI:H - When the out-of-bounds `linked_idx` reads as `0xff` and the ENTER bit is set, `new_port->active_idx = cam` performs a one-byte out-of-bounds heap write at the attacker-chosen offset, giving a controlled-location heap corruption primitive. Out-of-bounds writes into adjacent slab objects are exploitable for control-flow hijacking, and the corrupted value also alters the command sent to the Type-C PD controller.\nA:H - Reading and writing thousands of bytes beyond a `devm`-allocated object corrupts neighbouring slab objects or touches unmapped memory, producing slab corruption, KASAN reports, and kernel oops/panic. The attacker can repeat the write with different offsets until the system crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/typec/ucsi/ucsi_ccg.c" ], "versions": [ { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "d76923164705821aa1b01b8d9d1741f20c654ab4", "status": "affected", "versionType": "git" }, { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "8f47984b35f3be0cfc652c2ca358d5768ea3456b", "status": "affected", "versionType": "git" }, { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "604314ecd682913925980dc955caea2d036eab5f", "status": "affected", "versionType": "git" }, { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "69e19774f15e12dda6c6c58001d059e30895009b", "status": "affected", "versionType": "git" }, { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "3a2ba841659a0f15102585120dea75d8d5209616", "status": "affected", "versionType": "git" }, { "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e", "lessThan": "7dd08a0b4193087976db6b3ee7807de7e8316f96", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/typec/ucsi/ucsi_ccg.c" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.230", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.172", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.117", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.61", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.8", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.230" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.172" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.11.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d76923164705821aa1b01b8d9d1741f20c654ab4" }, { "url": "https://git.kernel.org/stable/c/8f47984b35f3be0cfc652c2ca358d5768ea3456b" }, { "url": "https://git.kernel.org/stable/c/604314ecd682913925980dc955caea2d036eab5f" }, { "url": "https://git.kernel.org/stable/c/69e19774f15e12dda6c6c58001d059e30895009b" }, { "url": "https://git.kernel.org/stable/c/3a2ba841659a0f15102585120dea75d8d5209616" }, { "url": "https://git.kernel.org/stable/c/7dd08a0b4193087976db6b3ee7807de7e8316f96" } ], "title": "usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50268", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:15:13.462825Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:23.672Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:27:48.152Z" } } ] } }