CVE-2024-50268

Summary

CVE-2024-50268 is a newly identified vulnerability affecting the Linux kernel. This issue lies in the "usb: typec" subsystem, specifically in the function "ucsi_ccg_update_set_new_cam_cmd()". The vulnerability arises due to an out-of-bounds issue with the "*cmd" variable, which can be manipulated by users via debugfs. As a result, the size of the "new_cam" parameter can exceed the limit of the "uc->updated[]" array (UCSI_MAX_ALTMODES), causing potential buffer overflows. The call tree involving this issue includes functions such as "ucsi_cmd()", "ucsi_send_command()", and "ucsi_ccg_sync_control()".

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.