CVE-2024-50268

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

The "*cmd" variable can be controlled by the user via debugfs. That means

"new_cam" can be as high as 255 while the size of the uc->updated[] array

is UCSI_MAX_ALTMODES (30).

The call tree is:

ucsi_cmd() // val comes from simple_attr_write_xsigned()

-> ucsi_send_command()

-> ucsi_send_command_common()

-> ucsi_run_command() // calls ucsi->ops->sync_control()

-> ucsi_ccg_sync_control()