CVE-2024-50268

What it actually does

User-controlled value via debugfs allows new_cam up to 255 to index beyond the 30-element uc->updated[] array in ucsi_ccg_update_set_new_cam_cmd, causing out-of-bounds access during ucsi_ccg_sync_control.

Why it matters to the business

Potential kernel crashes, privilege escalation, or memory corruption on Linux systems using the affected USB Type-C driver; low immediate ransomware risk but high prevalence in enterprise kernels increases exposure window after 692 days since publication.

How an attack unfolds

An attacker with local access writes an oversized value through simple_attr_write_xsigned into the debugfs attribute, which flows through nucsi_cmd, ucsi_send_command_common, and ucsi_run_command into ucsi_ccg_sync_control, triggering the out-of-bounds write or read; campaigns by espionage and financially motivated actors have targeted similar Linux kernel out-of-bounds issues.

How to fix it

Upgrade flashplugin-nonfree (Ubuntu:14.04:LTS) to 11.2.202.554ubuntu0.14.04.1; restrict debugfs mounts and disable unnecessary UCSI CCG interfaces until patched.

How to confirm the fix worked

Verify installed package version matches or exceeds the listed fixed version; confirm absence of the vulnerable ucsi_ccg_update_set_new_cam_cmd path via kernel source inspection or runtime debugfs attribute bounds checks.

Typical attack path

1. Obtain local access and locate the ucsi_ccg debugfs entry
2. Write value >= 30 to the cmd attribute controlling new_cam
3. Invoke ucsi_send_command to reach ucsi_ccg_sync_control
4. Trigger out-of-bounds array access for crash or corruption

How to detect it

Search system logs and audit trails for writes to ucsi-related debugfs attributes, unexpected calls to ucsi_ccg_sync_control, or kernel stack traces showing out-of-bounds access in the typec driver; correlate with threat actor TTPs for Linux kernel out-of-bounds vulnerabilities.

• ucsi_ccg_update_set_new_cam_cmd
• new_cam value exceeding 30
• ucsi_ccg_sync_control
• simple_attr_write_xsigned ucsi

What your security team should do

• Apply the listed fixed package version immediately across all affected Ubuntu 14.04 systems
• Mount debugfs with restricted permissions or disable it where possible
• Monitor for kernel oops or panics referencing ucsi_ccg
• Harden local access controls to limit debugfs exposure