CVE-2024-50268

A flaw was found in the Linux kernel. A local user with access to the debugfs debugging interface can supply malformed command values to the USB Type-C Connector System Software Interface (UCSI) driver, triggering an out-of-bounds memory read. This flaw primarily allows an attacker to cause a Denial of Service (DoS) through a system crash, or potentially lead to information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the Cypress CCgx Type-C driver module (ucsi_ccg) from being loaded by adding it to the modprobe configuration:

1. Create a configuration file to disable the module:

echo "install ucsi_ccg /bin/true" > /etc/modprobe.d/disable-ucsi_ccg.conf

2. Unload the module if it is currently loaded:

modprobe -r ucsi_ccg

Caveats: Disabling this module prevents the kernel from managing supported Cypress CCgx USB Type-C controllers. A system restart may be required if the module is actively in use and cannot be unloaded dynamically.