Linux Kernel USB Type-C Header Validation Vulnerability in TCPCI Maxim Driver

A vulnerability exists in the Linux kernel's USB Type-C TCPCI Maxim driver, specifically in the handling of data objects transmitted from a port. A malicious or broken port can send a CRC-valid frame that claims to include up to seven data objects, but the actual content is less. This discrepancy can lead to the kernel reading from uninitialized stack memory. The vulnerability has been addressed by adding a validation check to ensure that the number of data objects matches what is advertised in the header, thereby preventing the erroneous reading from memory.

Impact

Exploitation of this vulnerability could lead to undefined behavior in the kernel, including potential memory corruption, by allowing the reading of uninitialized stack memory.

Reproduction

The vulnerability can be reproduced by connecting a USB Type-C port that sends a CRC-valid frame with a header indicating a certain number of data objects, while the actual data objects transmitted are fewer than claimed. This can be done by manipulating the port's data transmission to create the mismatch, taking advantage of the driver's lack of proper validation.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.