CVE-2024-53203

A flaw was found in the Linux kernel's USB Type-C driver. A local user with administrative privileges can exploit this flaw by providing a crafted command through the debug file system (debugfs). This issue results in an array underflow and out-of-bounds memory access, which may lead to a system crash and Denial of Service (DoS).

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disabling the ucsi_ccg kernel module prevents the vulnerable driver from loading.

To blacklist the module and prevent autoloading, run:

echo "install ucsi_ccg /bin/true" > /etc/modprobe.d/disable-ucsi_ccg.conf

If the module is already loaded in memory, a system restart is required to completely unload it.

Caveats: Blacklisting this driver disables Cypress Type-C controller management and associated UCSI functionality for connected devices.