usb: typec: bus: verify partner exists in typec_altmode_attention
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 5 fixed, 3 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the alt mode. The data role swap causes the device to unregister all alt modes, however the usb hub will still send Attention messages even after failing to reregister the Alt Mode. type_altmode_attention currently does not verify whether or not a device's altmode partner exists, which results in a NULL pointer error when dereferencing the typec_altmode and typec_altmode_ops belonging to the altmode partner. Verify the presence of a device's altmode partner before sending the Attention message to the Alt Mode driver.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Red Hat 1 advisory
- RHSA-2024:9315 Released 2024-11-12 · Red Hat rating Moderatekernel security update
- Red Hat CodeReady Linux Builder (v. 9) kernel-cross-headers-5.14.0-503.11.1.el9_5, kernel-tools-libs-devel-5.14.0-503.11.1.el9_5, libperf-5.14.0-503.11.1.el9_5
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-503.11.1.el9_5, kernel-64k-debug-devel-matched-5.14.0-503.11.1.el9_5, kernel-64k-devel-5.14.0-503.11.1.el9_5 +12
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.4.0-503.11.1.el9_5, kernel-5.14.0-503.11.1.el9_5, kernel-64k-5.14.0-503.11.1.el9_5 +30
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-503.11.1.el9_5, kernel-rt-core-5.14.0-503.11.1.el9_5, kernel-rt-debug-5.14.0-503.11.1.el9_5 +9
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-503.11.1.el9_5, kernel-rt-core-5.14.0-503.11.1.el9_5, kernel-rt-debug-5.14.0-503.11.1.el9_5 +11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:9315 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:9315 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:9315 |
| Red Hat Enterprise Linux Real Time (v. 9) | Fixed | RHSA-2024:9315 |
| Red Hat Enterprise Linux Real Time for NFV (v. 9) | Fixed | RHSA-2024:9315 |
Not affected: 4 products
- Red Hat CodeReady Linux Builder (v. 9)
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux AppStream (v. 9)
Timeline
- 2026-10-02 Threatist record created from CVE-2023-54299
- 2026-10-03 Alias added: GHSA-4784-9v76-jqjx
References
Other 7
- https://git.kernel.org/stable/c/5f71716772b88cbe0e1788f6a38d7871aff2120b
- https://git.kernel.org/stable/c/38e1f2ee82bacbbfded8f1c06794a443d038d054
- https://git.kernel.org/stable/c/0ad6bad31da692f8d7acacab07eabe7586239ae0
- https://git.kernel.org/stable/c/0d3b5fe47938e9c451466845304a2bd74e967a80
- https://git.kernel.org/stable/c/d49547950bf7f3480d6ca05fe055978e5f0d9e5b
- https://git.kernel.org/stable/c/1101867a1711c27d8bbe0e83136bec47f8c1ca2a
- https://git.kernel.org/stable/c/f23643306430f86e2f413ee2b986e0773e79da31
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2023-54299 · CVE Program
- CVE-2023-54299 · NVD
- FIRST EPSS
- GHSA-4784-9v76-jqjx · GitHub Advisory Database · CC BY 4.0
- CVE-2023-54299 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences