{"id":"CVE-2021-46980","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Retrieve all the PDOs instead of just the first 4\n\ncommit 4dbc6a4ef06d (\"usb: typec: ucsi: save power data objects\nin PD mode\") introduced retrieval of the PDOs when connected to a\nPD-capable source. But only the first 4 PDOs are received since\nthat is the maximum number that can be fetched at a time given the\nMESSAGE_IN length limitation (16 bytes). However, as per the PD spec\na connected source may advertise up to a maximum of 7 PDOs.\n\nIf such a source is connected it's possible the PPM could have\nnegotiated a power contract with one of the PDOs at index greater\nthan 4, and would be reflected in the request data object's (RDO)\nobject position field. This would result in an out-of-bounds access\nwhen the rdo_index() is used to index into the src_pdos array in\nucsi_psy_get_voltage_now().\n\nWith the help of the UBSAN -fsanitize=array-bounds checker enabled\nthis exact issue is revealed when connecting to a PD source adapter\nthat advertise 5 PDOs and the PPM enters a contract having selected\nthe 5th one.\n\n[  151.545106][   T70] Unexpected kernel BRK exception at EL1\n[  151.545112][   T70] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP\n...\n[  151.545499][   T70] pc : ucsi_psy_get_prop+0x208/0x20c\n[  151.545507][   T70] lr : power_supply_show_property+0xc0/0x328\n...\n[  151.545542][   T70] Call trace:\n[  151.545544][   T70]  ucsi_psy_get_prop+0x208/0x20c\n[  151.545546][   T70]  power_supply_uevent+0x1a4/0x2f0\n[  151.545550][   T70]  dev_uevent+0x200/0x384\n[  151.545555][   T70]  kobject_uevent_env+0x1d4/0x7e8\n[  151.545557][   T70]  power_supply_changed_work+0x174/0x31c\n[  151.545562][   T70]  process_one_work+0x244/0x6f0\n[  151.545564][   T70]  worker_thread+0x3e0/0xa64\n\nWe can resolve this by instead retrieving and storing up to the\nmaximum of 7 PDOs in the con-\u003esrc_pdos array. This would involve\ntwo calls to the GET_PDOS command.","modified":"2026-03-13T05:17:58.397583Z","published":"2024-02-28T09:15:37.273Z","related":["SUSE-SU-2024:1465-1","SUSE-SU-2024:1489-1"],"references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/e5366bea0277425e1868ba20eeb27c879d5a6e2d"},{"type":"FIX","url":"https://git.kernel.org/stable/c/1f4642b72be79757f050924a9b9673b6a02034bc"},{"type":"FIX","url":"https://git.kernel.org/stable/c/5e9c6f58b01e6fdfbc740390c01f542a35c97e57"},{"type":"FIX","url":"https://git.kernel.org/stable/c/a453bfd7ef15fd9d524004d3ca7b05353a302911"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46980.json","unresolved_ranges":[{"events":[{"introduced":"5.8"},{"fixed":"5.10.38"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.11.22"}]},{"events":[{"introduced":"5.12"},{"fixed":"5.12.5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc1"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}