Linux Kernel UCSI CCG Firmware Image Validation Vulnerability Causes Denial-of-Service

A denial-of-service vulnerability has been identified in the Linux kernel's USB Type-C UCSI CCG driver. The issue arises in the firmware update process, specifically within the 'do_flash()' function, which handles firmware images for USB Type-C controllers. When a firmware image lacks a ':' record header, the function improperly processes the image, leading to a kernel crash. This flaw can be exploited by a root user who places a crafted firmware file in the '/lib/firmware' directory and writes to the 'do_flash' sysfs attribute, triggering the crash.

Impact

Exploitation of this vulnerability causes a kernel oops, leading to a crash of the affected system.

Reproduction

To reproduce this vulnerability, a root user must create a firmware file that does not include a ':' record header and place it in the '/lib/firmware' directory. Then, the user can write to the 'do_flash' sysfs attribute, which will initiate the firmware update process. The 'do_flash()' function will attempt to process the crafted firmware image, and the absence of the required header will cause the function to call 'strnchr()' with invalid parameters, leading to a crash.

Remediation

The vulnerability has been patched in the Linux kernel. Users should upgrade to the latest version available in the Linux kernel stable tree.