Off-by-One Error in USB Type-C Power Delivery - Linux Kernel Vulnerability
Summary
DEBIAN-CVE-2024-26995: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including device management, process scheduling, and system calls. This vulnerability affects the USB Type-C Power Delivery (PD) subsystem, which is responsible for negotiating power transfer between devices. The issue arises from incorrect counting of Power Data Objects (PDOs), leading to potential power negotiation errors.
Vulnerability Detail
In the Linux kernel, an off-by-one error occurs in the USB Type-C Power Delivery subsystem due to incorrect handling of the number of sink and source PDOs. This miscalculation can lead to incorrect power negotiation, resulting in overvoltage or overcurrent situations. Specifically, the variables 'nr_snk_pdo' and 'nr_src_pdo' are improperly incremented, causing the loop index to exceed the actual number of PDOs. This flaw can result in sending incorrect Request Data Objects (RDOs) during power negotiations, potentially damaging connected devices or causing unexpected resets.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to avoid potential risks.
Conclusion
The off-by-one error in the USB Type-C Power Delivery subsystem of the Linux kernel poses significant risks related to power negotiation. Users are advised to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an off-by-one error in the USB Type-C Power Delivery subsystem of the Linux kernel, which can lead to incorrect power negotiation.
If exploited, this vulnerability can cause overvoltage or overcurrent conditions, potentially damaging connected devices or causing system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the patched version of the Linux package is 6.8.9-1 for Debian 13 and 14. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
