CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the USB Type-C Port Manager, specifically in the `svdm_consume_modes()` function, where an out-of-bounds read can occur due to insufficient validation of the SVID index. This flaw allows an attacker to manipulate the SVID value, potentially leading to arbitrary code execution or other malicious actions by injecting a chosen SVID into the system. Organizations using affected Linux distributions should prioritize patching this vulnerability to safeguard against potential exploitation, particularly those relying on USB Type-C interfaces in their infrastructure.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation: paltmode->svid = pmdata->svids[pmdata->svid_index]; If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs. By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode(). Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().