CVE-2025-71108

// PoC: 触发UCSI num_connectors字段解析错误 // 此PoC模拟问题固件的数据结构，用于验证内核补丁的修复效果 #include <stdio.h> #include <stdint.h> // UCSI connector capability structure struct ucsi_connector_capability { uint8_t num_connectors; // Buggy FW sets bit 7 (reserved) uint8_t op_mode; uint16_t flags; } __attribute__((packed)); // Simulate buggy firmware data (bit 7 set incorrectly) unsigned char buggy_firmware_data[] = { 0x82, // num_connectors with reserved bit set (should be 0x02) 0x01, // operating mode 0x00, 0x00 // flags }; int main() { struct ucsi_connector_capability *cap = (struct ucsi_connector_capability *)buggy_firmware_data; printf("Buggy num_connectors value: 0x%02x (%d)\n", cap->num_connectors, cap->num_connectors); // Vulnerable code (without fix) printf("Without fix - num_connectors: %d\n", cap->num_connectors); // Fixed code (with bitmask) uint8_t fixed_num_connectors = cap->num_connectors & 0x7F; printf("With fix (0x7F mask) - num_connectors: %d\n", fixed_num_connectors); // Verify the fix if (fixed_num_connectors <= 127 && (cap->num_connectors & 0x80)) { printf("WARNING: Firmware sets reserved bit in num_connectors!\n"); printf("Auto-corrected value from %d to %d\n", cap->num_connectors, fixed_num_connectors); } return 0; }

{"cve": {"id": "CVE-2025-71108", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-14T15:15:59.867", "lastModified": "2026-03-25T19:32:29.920", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Handle incorrect num_connectors capability\n\nThe UCSI spec states that the num_connectors field is 7 bits, and the\n8th bit is reserved and should be set to zero.\nSome buggy FW has been known to set this bit, and it can lead to a\nsystem not booting.\nFlag that the FW is not behaving correctly, and auto-fix the value\nso that the system boots correctly.\n\nFound on Lenovo P1 G8 during Linux enablement program. The FW will\nbe fixed, but seemed worth addressing in case it hit platforms that\naren't officially Linux supported."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: typec: ucsi: Manejar capacidad incorrecta de num_connectors\n\nLa especificación UCSI establece que el campo num_connectors es de 7 bits, y el octavo bit está reservado y debe establecerse a cero.\nSe sabe que algunos FW defectuosos han establecido este bit, y esto puede llevar a que un sistema no arranque.\nIndicar que el FW no se está comportando correctamente y corregir automáticamente el valor para que el sistema arranque correctamente.\n\nEncontrado en Lenovo P1 G8 durante el programa de habilitación de Linux. El FW se corregirá, pero pareció valer la pena abordarlo en caso de que afectara a plataformas que no son oficialmente compatibles con Linux."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13.1", "versionEndExcluding": "5.10.248", "matchCriteriaId": "D2C64CF0-61CE-45C3-A39A-36D8128BBDCD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.198", "matchCriteriaId": "82159CAA-B6BA-43C6-85D8-65BDBC175A7E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.160", "matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.120", "matchCriteriaId": "43C3A206-5EEE-417B-AA0F-EF8972E7A9F0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.64", "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.3", "matchCriteriaId": "2DC484D8-FB4F-4112-900F-AE333B6FE7A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:4.13:-:*:*:*:*:*:*", "matchCriteriaId": "40253A59-8422-42B7-B45F-FF9C4A824F3E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/07c8d2a109d847775b3b4e2c3294c8e1eea7 ... (truncated)