CVE-2024-35924

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The UCSI core is a local platform driver (ACPI OpRegion, I2C, or pmic_glink transport) with no network or adjacent-network exposure; the over-read is driven by local UCSI transactions and the leaked bytes are harvested locally through /sys/class/typec and /sys/class/power_supply attributes or the UCSI debugfs response file.

AC:LAttack complexity, low

There is no race and no dependence on memory layout the attacker cannot influence — any UCSI command requesting more than 16 bytes on a PPM reporting version ≤1.2 deterministically reads past the MESSAGE_IN window, and UCSI 1.x PPMs were the common case on shipping hardware.

PR:LPrivileges required, low

The typec class attributes populated from the over-read buffers (usb_power_delivery_revision, number_of_alternate_modes, power_operation_mode, supported_accessory_modes) and the ucsi power-supply properties derived from src_pdos are all DEVICE_ATTR_RO/0444, so an ordinary unprivileged local user can read the disclosed bytes; no capability or root is required to observe the leak.

UI:NUser interaction, none

The oversized MESSAGE_IN reads are issued by the driver itself during registration, resume, and connector-change work handling; no victim action is needed for the out-of-bounds access to occur or for its results to be exposed.

S:UScope, unchanged

The out-of-bounds read stays within the kernel's own memory (memremap'd OpRegion, or the slab objects backing struct pmic_glink_ucsi / struct ucsi_ccg) and is consumed by the same kernel; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Up to 240 bytes beyond the 16-byte MESSAGE_IN window can be copied out — past read_buf[48] inside struct pmic_glink_ucsi, past the trailing op_data member of struct ucsi_ccg, or past the ACPI OpRegion — which is far more than a strictly bounded few-byte read and can expose adjacent heap contents (including pointers) through world-readable sysfs.

I:NIntegrity impact, none

The defect is purely an over-long read; every destination buffer is sized to the requested length, so no out-of-bounds write, allocation-size confusion, or control-flow corruption primitive is created.

A:HAvailability impact, high

Reading hundreds of bytes past the end of a memremap'd ACPI/MMIO OpRegion can fault on platforms where the mapping does not extend that far, and the slab over-reads in the ccg and glink backends trip KASAN, so the bug can take the machine down.