Linux Kernel UCSI Connector Number Validation Vulnerability

A vulnerability exists in the Linux kernel's USB Type-C UCSI driver, specifically in the 'ucsi_connector_change' function. This issue arises because the function does not properly validate the connector number received from the Port Partner Manager (PPM) before using it to access an internal array. As a result, a faulty or malicious PPM can manipulate the system to execute scheduled work on memory beyond the array's bounds, potentially leading to memory corruption. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability can cause a heap-based buffer overflow, allowing for memory corruption.

Reproduction

To reproduce this vulnerability, a UCSI controller must be attached via I2C to a device running an affected version of the Linux kernel. The controller can then be manipulated to send invalid connector numbers that exceed the reported maximum, bypassing the array's bounds and causing a buffer overflow.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.