CVE-2024-35924

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

The Linux kernel CVE team has assigned CVE-2024-35924 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35924-90f6@gregkh/T

This vulnerability is rated with a Low severity impact because exploitation requires local access on systems hosting specific USB Type-C hardware implementing the UCSI 1.2 interface, an uncommon configuration in enterprise server deployments. The flaw causes an out-of-bounds read when processing interface messages from older specification hardware, presenting at most a denial of service condition without providing direct code execution or remote reachability. Consequently, typical server workloads are not exposed under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.