Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0a4c005bd1715d8b32a368ed5516a6ee7e603d18 to < a39d53f70e637ff3970046c32106a0e64fca62cdaffected0a4c005bd1715d8b32a368ed5516a6ee7e603d18 to < 4b6823ce0e548491cb9663303cba28e18d351096affected0a4c005bd1715d8b32a368ed5516a6ee7e603d18 to < 282be6ae8be791762740107c79cecf5121f66063affected0a4c005bd1715d8b32a368ed5516a6ee7e603d18 to < dac0c073c6ad5f1bbb5e9fea9023fc1b4dab5e14affected0a4c005bd1715d8b32a368ed5516a6ee7e603d18 to < c4b27b3605788bbf9e4251f3cd4ab94645ab036faffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a39d53f70e637ff3970046c32106a0e64fca62cd ↗
- https://git.kernel.org/stable/c/4b6823ce0e548491cb9663303cba28e18d351096 ↗
- https://git.kernel.org/stable/c/282be6ae8be791762740107c79cecf5121f66063 ↗
- https://git.kernel.org/stable/c/dac0c073c6ad5f1bbb5e9fea9023fc1b4dab5e14 ↗
- https://git.kernel.org/stable/c/c4b27b3605788bbf9e4251f3cd4ab94645ab036f ↗