CVE-2024-35924 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI version to truncate read sizes on UCSI v1.2.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10	cpe:/a:redhat:enterprise_linux:8::nfv	RHSA-2024:5102	2024-08-08T00:00:00Z
kernel-0:4.18.0-553.16.1.el8_10	cpe:/o:redhat:enterprise_linux:8	RHSA-2024:5101	2024-08-08T00:00:00Z

References

Link	Providers
https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f
https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40
https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527
https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35924-90f6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-35924
https://www.cve.org/CVERecord?id=CVE-2024-35924

History

Thu, 08 Aug 2024 23:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:8::nfv cpe:/o:redhat:enterprise_linux:8
Vendors & Products		Redhat Redhat enterprise Linux

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-19T10:10:35.044Z

Updated: 2024-08-02T03:21:48.935Z

Reserved: 2024-05-17T13:50:33.125Z

Link: CVE-2024-35924

Vulnrichment

Updated: 2024-05-23T19:01:24.910Z

NVD

Status : Awaiting Analysis

Published: 2024-05-19T11:15:48.653

Modified: 2024-05-20T13:00:04.957

Link: CVE-2024-35924

Redhat

Severity : Low

Publid Date: 2024-05-19T00:00:00Z

Links: CVE-2024-35924 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35924", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.125Z", "datePublished": "2024-05-19T10:10:35.044Z", "dateUpdated": "2024-08-02T03:21:48.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:31:19.844Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Limit read size on v1.2\n\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi.c", "drivers/usb/typec/ucsi/ucsi.h"], "versions": [{"version": "1da177e4c3f4", "lessThan": "266f403ec475", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "0defcaa09d3b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b3db266fb031", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi.c", "drivers/usb/typec/ucsi/ucsi.h"], "versions": [{"version": "6.6.27", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8.6", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40"}, {"url": "https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f"}, {"url": "https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527"}], "title": "usb: typec: ucsi: Limit read size on v1.2", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T15:11:13.299971Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:40.719Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.935Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35924", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.125Z", "datePublished": "2024-05-19T10:10:35.044Z", "dateUpdated": "2024-06-04T17:34:40.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:31:19.844Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Limit read size on v1.2\n\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi.c", "drivers/usb/typec/ucsi/ucsi.h"], "versions": [{"version": "1da177e4c3f4", "lessThan": "266f403ec475", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "0defcaa09d3b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b3db266fb031", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/typec/ucsi/ucsi.c", "drivers/usb/typec/ucsi/ucsi.h"], "versions": [{"version": "6.6.27", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8.6", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40"}, {"url": "https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f"}, {"url": "https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527"}], "title": "usb: typec: ucsi: Limit read size on v1.2", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T15:11:13.299971Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.910Z"}, "title": "CISA ADP Vulnrichment"}]}}