CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of UCSI connector notifications, specifically in the ucsi_connector_change() function, which improperly validates connector numbers. This flaw allows a malicious or faulty Power Management Processor (PPM) to trigger memory access beyond the allocated array, potentially leading to memory corruption or arbitrary code execution. Organizations using Linux systems with UCSI controllers, particularly those relying on EC firmware or I2C connections, should prioritize addressing this vulnerability to mitigate security risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array.