CVE-2024-50268 (GCVE-0-2024-50268)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:42
VLAI
Title
usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control()
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < d76923164705821aa1b01b8d9d1741f20c654ab4 (git)
Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < 8f47984b35f3be0cfc652c2ca358d5768ea3456b (git)
Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < 604314ecd682913925980dc955caea2d036eab5f (git)
Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < 69e19774f15e12dda6c6c58001d059e30895009b (git)
Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < 3a2ba841659a0f15102585120dea75d8d5209616 (git)
Affected: 170a6726d0e266f2c8f306e3d61715c32f4ee41e , < 7dd08a0b4193087976db6b3ee7807de7e8316f96 (git)
Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.230 , ≤ 5.10.* (semver)
Unaffected: 5.15.172 , ≤ 5.15.* (semver)
Unaffected: 6.1.117 , ≤ 6.1.* (semver)
Unaffected: 6.6.61 , ≤ 6.6.* (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50268",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:15:13.462825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:23.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:27:48.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d76923164705821aa1b01b8d9d1741f20c654ab4",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            },
            {
              "lessThan": "8f47984b35f3be0cfc652c2ca358d5768ea3456b",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            },
            {
              "lessThan": "604314ecd682913925980dc955caea2d036eab5f",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            },
            {
              "lessThan": "69e19774f15e12dda6c6c58001d059e30895009b",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            },
            {
              "lessThan": "3a2ba841659a0f15102585120dea75d8d5209616",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            },
            {
              "lessThan": "7dd08a0b4193087976db6b3ee7807de7e8316f96",
              "status": "affected",
              "version": "170a6726d0e266f2c8f306e3d61715c32f4ee41e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi_ccg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.172",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()\n\nThe \"*cmd\" variable can be controlled by the user via debugfs.  That means\n\"new_cam\" can be as high as 255 while the size of the uc-\u003eupdated[] array\nis UCSI_MAX_ALTMODES (30).\n\nThe call tree is:\nucsi_cmd() // val comes from simple_attr_write_xsigned()\n-\u003e ucsi_send_command()\n   -\u003e ucsi_send_command_common()\n      -\u003e ucsi_run_command() // calls ucsi-\u003eops-\u003esync_control()\n         -\u003e ucsi_ccg_sync_control()"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled `*cmd` value originates from a local write to the UCSI debugfs `command` file on the local system, not from any network or remote peer input. No physical access is required to issue the malformed command itself.\nAC:L - The index is taken verbatim from bits 24-31 of the value the attacker writes, so the out-of-bounds access is deterministic and repeatable with no race or memory-layout guessing. The `has_multiple_dp` precondition is under the attacker\u0027s own control since a local attacker can attach a Type-C partner advertising multiple DP alternate modes.\nPR:L - Reaching the code requires write access to the UCSI debugfs interface, which is an authenticated local account with access to the debugfs mount rather than any remote or unauthenticated position. Consistent with prior kernel.org scoring of debugfs-reachable overflows, this is treated as low privilege rather than high.\nUI:N - The attacker triggers the flaw entirely on their own by writing the crafted UCSI command; no separate victim needs to open a file, mount a filesystem, or take any other action. Establishing the multi-DP connector state is an action the attacker performs themselves, not a victim.\nS:U - The out-of-bounds access corrupts kernel heap memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `new_port-\u003elinked_idx` and `new_port-\u003esvid` are read from an attacker-selected offset ranging up to roughly 2 KB past the end of the `updated[]` array and past the containing `struct ucsi_ccg` allocation, so this is a wide-ranging heap out-of-bounds read rather than a tightly bounded one. The disclosed bytes steer subsequent control flow and the command value programmed into the PD controller, and such heap OOB reads are leverageable for broader kernel memory disclosure.\nI:H - When the out-of-bounds `linked_idx` reads as `0xff` and the ENTER bit is set, `new_port-\u003eactive_idx = cam` performs a one-byte out-of-bounds heap write at the attacker-chosen offset, giving a controlled-location heap corruption primitive. Out-of-bounds writes into adjacent slab objects are exploitable for control-flow hijacking, and the corrupted value also alters the command sent to the Type-C PD controller.\nA:H - Reading and writing thousands of bytes beyond a `devm`-allocated object corrupts neighbouring slab objects or touches unmapped memory, producing slab corruption, KASAN reports, and kernel oops/panic. The attacker can repeat the write with different offsets until the system crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:56.179Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d76923164705821aa1b01b8d9d1741f20c654ab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f47984b35f3be0cfc652c2ca358d5768ea3456b"
        },
        {
          "url": "https://git.kernel.org/stable/c/604314ecd682913925980dc955caea2d036eab5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/69e19774f15e12dda6c6c58001d059e30895009b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a2ba841659a0f15102585120dea75d8d5209616"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dd08a0b4193087976db6b3ee7807de7e8316f96"
        }
      ],
      "title": "usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50268",
    "datePublished": "2024-11-19T01:30:05.437Z",
    "dateReserved": "2024-10-21T19:36:19.982Z",
    "dateUpdated": "2026-08-05T11:42:56.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50268",
      "date": "2026-08-12",
      "epss": "0.00262",
      "percentile": "0.17993"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:10:24.000Z",
      "cve": "CVE-2024-50268",
      "id": "msrc_CVE-2024-50268",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50268.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50268\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-19T02:16:28.787\",\"lastModified\":\"2026-08-04T11:21:38.907\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()\\n\\nThe \\\"*cmd\\\" variable can be controlled by the user via debugfs.  That means\\n\\\"new_cam\\\" can be as high as 255 while the size of the uc-\u003eupdated[] array\\nis UCSI_MAX_ALTMODES (30).\\n\\nThe call tree is:\\nucsi_cmd() // val comes from simple_attr_write_xsigned()\\n-\u003e ucsi_send_command()\\n   -\u003e ucsi_send_command_common()\\n      -\u003e ucsi_run_command() // calls ucsi-\u003eops-\u003esync_control()\\n         -\u003e ucsi_ccg_sync_control()\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: se corrige un posible error fuera de los l\u00edmites en ucsi_ccg_update_set_new_cam_cmd() La variable \\\"*cmd\\\" puede ser controlada por el usuario a trav\u00e9s de debugfs. Esto significa que \\\"new_cam\\\" puede tener un valor de hasta 255, mientras que el tama\u00f1o de la matriz uc-\u0026gt;updated[] es UCSI_MAX_ALTMODES (30). El \u00e1rbol de llamadas es: ucsi_cmd() // val proviene de simple_attr_write_xsigned() -\u0026gt; ucsi_send_command() -\u0026gt; ucsi_send_command_common() -\u0026gt; ucsi_run_command() // llama a ucsi-\u0026gt;ops-\u0026gt;sync_control() -\u0026gt; ucsi_ccg_sync_control()\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/typec/ucsi/ucsi_ccg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"d76923164705821aa1b01b8d9d1741f20c654ab4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"8f47984b35f3be0cfc652c2ca358d5768ea3456b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"604314ecd682913925980dc955caea2d036eab5f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"69e19774f15e12dda6c6c58001d059e30895009b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"3a2ba841659a0f15102585120dea75d8d5209616\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"170a6726d0e266f2c8f306e3d61715c32f4ee41e\",\"lessThan\":\"7dd08a0b4193087976db6b3ee7807de7e8316f96\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/typec/ucsi/ucsi_ccg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.230\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.172\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.117\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.61\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.8\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:15:13.462825Z\",\"id\":\"CVE-2024-50268\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.10.230\",\"matchCriteriaId\":\"CA0181D1-C3B5-45D3-8100-3EAD5D3086C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.172\",\"matchCriteriaId\":\"88812664-4296-42AC-AE0F-ED71086C1BB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.117\",\"matchCriteriaId\":\"0DD7F755-2F6B-4707-8973-78496AD5AA8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.61\",\"matchCriteriaId\":\"630ED7EB-C97E-4435-B884-1E309E40D6F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.8\",\"matchCriteriaId\":\"0BD000F7-3DAD-4DD3-8906-98EA1EC67E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3a2ba841659a0f15102585120dea75d8d5209616\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/604314ecd682913925980dc955caea2d036eab5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69e19774f15e12dda6c6c58001d059e30895009b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7dd08a0b4193087976db6b3ee7807de7e8316f96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f47984b35f3be0cfc652c2ca358d5768ea3456b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d76923164705821aa1b01b8d9d1741f20c654ab4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:18:04+00:00",
      "cve": "CVE-2024-50268",
      "id": "CVE-2024-50268",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50268.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:27:48.152Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50268\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:15:13.462825Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:25:49.917Z\"}}], \"cna\": {\"title\": \"usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"d76923164705821aa1b01b8d9d1741f20c654ab4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"8f47984b35f3be0cfc652c2ca358d5768ea3456b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"604314ecd682913925980dc955caea2d036eab5f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"69e19774f15e12dda6c6c58001d059e30895009b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"3a2ba841659a0f15102585120dea75d8d5209616\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"170a6726d0e266f2c8f306e3d61715c32f4ee41e\", \"lessThan\": \"7dd08a0b4193087976db6b3ee7807de7e8316f96\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/typec/ucsi/ucsi_ccg.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.172\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.61\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/typec/ucsi/ucsi_ccg.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d76923164705821aa1b01b8d9d1741f20c654ab4\"}, {\"url\": \"https://git.kernel.org/stable/c/8f47984b35f3be0cfc652c2ca358d5768ea3456b\"}, {\"url\": \"https://git.kernel.org/stable/c/604314ecd682913925980dc955caea2d036eab5f\"}, {\"url\": \"https://git.kernel.org/stable/c/69e19774f15e12dda6c6c58001d059e30895009b\"}, {\"url\": \"https://git.kernel.org/stable/c/3a2ba841659a0f15102585120dea75d8d5209616\"}, {\"url\": \"https://git.kernel.org/stable/c/7dd08a0b4193087976db6b3ee7807de7e8316f96\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()\\n\\nThe \\\"*cmd\\\" variable can be controlled by the user via debugfs.  That means\\n\\\"new_cam\\\" can be as high as 255 while the size of the uc-\u003eupdated[] array\\nis UCSI_MAX_ALTMODES (30).\\n\\nThe call tree is:\\nucsi_cmd() // val comes from simple_attr_write_xsigned()\\n-\u003e ucsi_send_command()\\n   -\u003e ucsi_send_command_common()\\n      -\u003e ucsi_run_command() // calls ucsi-\u003eops-\u003esync_control()\\n         -\u003e ucsi_ccg_sync_control()\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.230\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.172\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.117\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.61\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:50:21.342Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50268\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:27:48.152Z\", \"dateReserved\": \"2024-10-21T19:36:19.982Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T01:30:05.437Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.