In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: displayport: Fix OOB altmode array index
The UCSI displayport driver indexes the connector's port altmode array
with the GET_CURRENT_CAM response after checking it is not 0xff. The
port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less
than UCSI_MAX_ALTMODES before accessing the port altmode array.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS Score: 7.7
AV:L - The OOB index is the PPM GET_CURRENT_CAM byte from onboard UCSI firmware (ACPI EC, I2C CCG/STM32G0, pmic_glink, Chrome OS EC), not a USB-C partner or network packet. A compromised PPM can report CONNECTED plus DP partner altmodes and drive enter without a physical plug, matching other firmware-to-kernel scores.
AC:L - The PPM fully controls the GET_CURRENT_CAM u8; any value in 30-254 (UCSI_MAX_ALTMODES is 30, 0xff is the only sentinel) deterministically indexes port_altmode[] out of bounds with no race or attacker-uncontrollable layout.
PR:N - UCSI connector-change work, GET_CURRENT_CAM, and dp_altmode_probe's automatic enter run in kernel context from PPM notifications with no capable() or credential check, so compromised PPM/EC firmware needs no host account.
UI:N - Partner registration and DisplayPort altmode enter run automatically from PPM connector-change events and dp_altmode_probe scheduled work; no victim must plug a cable, mount media, or open a device node.
S:U - The out-of-bounds pointer load stays inside the host kernel UCSI DisplayPort driver and connector heap; it does not cross a VM, IOMMU, or other security-authority boundary.
C:H - cur is a full u8 used as an index into port_altmode[UCSI_MAX_ALTMODES], so values 30-254 read a kernel pointer from up to about 2KB past the array into adjacent connector/heap memory; that unbounded OOB read scores Confidentiality High.
I:N - The OOB pointer is only compared to alt to choose 0 versus -EBUSY; it is never written, stored, or used as a write address, so there is no OOB write, use-after-free, or control-flow hijack primitive.
A:H - An out-of-range CAM can load from unmapped heap, trip KASAN/UBSAN array-index-out-of-bounds, or oops as the fix describes, producing a kernel panic that the PPM can retrigger on each enter.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The OOB index is the PPM GET_CURRENT_CAM byte from onboard UCSI firmware (ACPI EC, I2C CCG/STM32G0, pmic_glink, Chrome OS EC), not a USB-C partner or network packet. A compromised PPM can report CONNECTED plus DP partner altmodes and drive enter without a physical plug, matching other firmware-to-kernel scores.
AC:L - The PPM fully controls the GET_CURRENT_CAM u8; any value in 30-254 (UCSI_MAX_ALTMODES is 30, 0xff is the only sentinel) deterministically indexes port_altmode[] out of bounds with no race or attacker-uncontrollable layout.
PR:N - UCSI connector-change work, GET_CURRENT_CAM, and dp_altmode_probe's automatic enter run in kernel context from PPM notifications with no capable() or credential check, so compromised PPM/EC firmware needs no host account.
UI:N - Partner registration and DisplayPort altmode enter run automatically from PPM connector-change events and dp_altmode_probe scheduled work; no victim must plug a cable, mount media, or open a device node.
S:U - The out-of-bounds pointer load stays inside the host kernel UCSI DisplayPort driver and connector heap; it does not cross a VM, IOMMU, or other security-authority boundary.
C:H - cur is a full u8 used as an index into port_altmode[UCSI_MAX_ALTMODES], so values 30-254 read a kernel pointer from up to about 2KB past the array into adjacent connector/heap memory; that unbounded OOB read scores Confidentiality High.
I:N - The OOB pointer is only compared to alt to choose 0 versus -EBUSY; it is never written, stored, or used as a write address, so there is no OOB write, use-after-free, or control-flow hijack primitive.
A:H - An out-of-range CAM can load from unmapped heap, trip KASAN/UBSAN array-index-out-of-bounds, or oops as the fix describes, producing a kernel panic that the PPM can retrigger on each enter.
CVSS 3.1