CVE-2024-35924

What it actually does

The vulnerability permits oversized reads from the MESSAGE_IN region on UCSI v1.2 controllers because the driver did not truncate read lengths based on the negotiated UCSI version, allowing data beyond the 16-byte limit to be copied into kernel buffers.

Why it matters to the business

Systems running older Linux kernels with UCSI v1.2 hardware may experience kernel instability, crashes, or information disclosure when certain USB-C devices or controllers are attached, potentially disrupting operations on servers, workstations, and embedded devices that rely on USB Type-C.

How an attack unfolds

An attacker with physical or local access connects a malicious or specially crafted USB-C device that triggers UCSI v1.2 communication; the kernel driver issues an untruncated read, overflowing the intended buffer and leading to memory corruption that could be leveraged for denial of service or further exploitation.

How to fix it

Update the Linux kernel to a version containing commit 266f403ec47573046dee4bcebda82777ce702c40 or later; rebuild and deploy the updated kernel image on all affected systems; verify the UCSI driver version after reboot.

How to confirm the fix worked

Confirm the running kernel contains the fix commit; test with UCSI v1.2 hardware that the read size is correctly limited to 16 bytes; monitor kernel logs for absence of prior overflow-related warnings during USB-C attachment.

Typical attack path

1. Identify target system with UCSI v1.2 USB Type-C hardware running an unpatched kernel
2. Attach or simulate a USB-C peripheral that exercises the MESSAGE_IN path
3. Trigger oversized data response from the controller
4. Cause kernel buffer overflow during the read operation
5. Escalate to crash or attempt memory corruption exploitation

How to detect it

Search kernel logs for UCSI-related read operations or buffer warnings around USB Type-C attachment events; examine dmesg or syslog for anomalies in the ucsi driver prior to the fixed commit date.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-user systems within the next patch cycle
• Inventory devices using UCSI v1.2 controllers and schedule staged rollouts
• Add kernel version checks to vulnerability scanning tools
• Review USB-C device allow-lists if physical access controls are feasible