Linux Kernel WCOVE Type-C PD Message Buffer Overflow Vulnerability

A vulnerability in the Linux kernel's USB Type-C WCOVE driver allows for a buffer overflow in the Power Delivery (PD) message handling. The issue arises in the 'wcove_read_rx_buffer' function, where the PD RX FIFO is copied into a user-provided 'pd_message' structure. This operation can exceed the intended buffer size, leading to potential memory corruption. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability can cause a buffer overflow, leading to memory corruption. In the worst case, such buffer overflows can be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by using a USB Type-C device that sends a 31-byte frame, which is one byte more than the maximum allowed. This can be done by manipulating the PD message size during communication with a device that does not properly enforce the PD object-count limit.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for updating the kernel can be found in the official Linux kernel documentation.