Linux Kernel USB Type-C TCPM Altmode Buffer Overflow Vulnerability

A vulnerability in the Linux kernel's USB Type-C TCPM (Type-C Port Management) driver can lead to a buffer overflow in the altmode description array. This issue arises in the 'svdm_consume_modes' function, where the number of altmodes is checked against the array size only once before processing. While this oversight is typically harmless during normal SVID (Standard Vendor ID) discovery, it can be exploited by a malicious port partner. Such a partner can manipulate the altmode count and send additional VDOs (Vendor Defined Objects), causing the function to write past the allocated buffer. This vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to a buffer overflow, where data is written beyond the boundaries of the allocated array. This can potentially corrupt memory, cause unexpected behavior in the application, or create an opportunity for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by simulating a malicious USB Type-C port partner that sends an unsolicited 'Discover Modes' ACK with additional VDOs after the altmode count has been maximized through normal operations. This can be done by manipulating the TCPM's handling of SVID discoveries and ACK responses.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the updated kernel can be found on the official Linux kernel website.