Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_notify_common() The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsi_connector_change(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries). A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsi_connector_change(). Add a bounds check in ucsi_notify_common(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further.
Product status
bdc62f2bae8fb0e8e99574de5232f0a3c54a27df (git) before f6dcbf2b024d55549959402f1db6c614e51d52cb
bdc62f2bae8fb0e8e99574de5232f0a3c54a27df (git) before f4e608fe12b7ac6a4a57176ab0296bb5a110a078
bdc62f2bae8fb0e8e99574de5232f0a3c54a27df (git) before 98429e9ec89a5e3a204112dfaa2dbe6ca28493a0
bdc62f2bae8fb0e8e99574de5232f0a3c54a27df (git) before d2d8c17ac01a1b1f638ea5d340a884ccc5015186
5.5
Any version before 5.5
6.12.81 (semver)
6.18.22 (semver)
6.19.12 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/f6dcbf2b024d55549959402f1db6c614e51d52cb
git.kernel.org/...c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078
git.kernel.org/...c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0
git.kernel.org/...c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186