Linux Kernel up to 6.8.7/6.9-rc4 tcpm pd_set off-by-one

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.8.7/6.9-rc4 and classified as problematic. This vulnerability affects the function pd_set of the component tcpm. This manipulation causes off-by-one. This vulnerability appears as CVE-2024-26995. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.8.7/6.9-rc4. It has been declared as problematic. Affected by this vulnerability is the function pd_set of the component tcpm. The manipulation with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one. When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as the size of the local sink PDO array to match the Source capabilities of the partner port. If the off-by-one overflow occurs, a wrong RDO might be sent and unexpected power transfer might happen such as over voltage or over current (than expected). "nr_src_pdo" is used to set the Rp level when the port is in Source role. It is also the array size of the local Source capabilities when filling up the buffer which will be sent as the Source PDOs (such as in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp level might be set and wrong Source PDOs will be sent to the partner port. This could potentially cause over current or port resets.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2024-26995 since 02/19/2024. The exploitation appears to be easy. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/06/2026).

Upgrading to version 6.8.8 or 6.9-rc5 eliminates this vulnerability. Applying the patch f3da3192cdd3/c4128304c216 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2024-1008). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Oracle VM
• EMC Avamar
• IBM QRadar SIEM
• Dell NetWorker
• IBM Security Guardium
• RESF Rocky Linux
• Broadcom Brocade SANnav
• Open Source Linux Kernel
• IBM Business Automation Workflow
• IBM Spectrum Protect Plus
• Dell Avamar
• Juniper Junos Space
• IBM DataPower Gateway
• IBM Storage Scale System
• SolarWinds Security Event Manager
• Dell PowerProtect Data Domain
• Dell PowerScale OneFS

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.9-rc1
• 6.9-rc2
• 6.9-rc3
• 6.9-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion