CVE-2024-35924

CVE-2024-35924

High · published May 19, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was

increased from 16 to 256. In order to avoid overflowing reads for older

systems, add a mechanism to use the read UCSI version to truncate read

sizes on UCSI v1.2.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.8th percentile
Published
2024-05-19T15:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 5.5, < 6.6.276.6.27
linux/linux_kernel≥ 6.7, < 6.8.66.8.6
References (6)
https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 MAY 10:10Z
    usb: typec: ucsi: Limit read size on v1.2
    cvelistv5