CVE-2024-35924: linux-libc-dev - kernel: usb: typec: ucsi: Limit read size on v1.2
Summary
CVE-2024-35924: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. This vulnerability affects the linux-libc-dev package version 6.1.90-1.
Vulnerability Detail
The vulnerability CVE-2024-35924 has been identified in the linux-libc-dev package. It is related to the USB Type-C UCSI (USB Type-C System Software Interface) driver in the Linux kernel. The vulnerability arises from a limitation in the read size on UCSI v1.2. The size of the MESSAGE_IN region was increased from 16 to 256 between UCSI 1.2 and UCSI 2.0. However, to prevent overflowing reads for older systems, a mechanism to truncate read sizes on UCSI v1.2 was not implemented. This vulnerability could be exploited by an attacker to cause a denial of service (DoS) condition on affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package version 6.1.90-1 is affected by a vulnerability that could allow an attacker to cause a denial of service (DoS) condition. It is recommended to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
This vulnerability could be exploited by an attacker to cause a denial of service (DoS) condition on affected systems.
The linux-libc-dev package version 6.1.90-1 is affected by this vulnerability.
Yes, the package maintainers have released a fix for this vulnerability. It is recommended to update to the latest version of the linux-libc-dev package.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability on the Debian Security Tracker website and the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for linux.
