PT-2024-11089 · Linux+1 · Linux Kernel+1

Subbaraman Narayanamurthy · Published 2021-05-10 · Updated 2024-12-31 · CVE-2021-46980

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises from the Linux kernel's handling of Power Data Objects (PDOs) when connected to a PD-capable source. The kernel only receives the first 4 PDOs due to the MESSAGE IN length limitation of 16 bytes, despite the PD spec allowing up to 7 PDOs. If a source advertises more than 4 PDOs and the Power Power Manager (PPM) negotiates a power contract with one of these PDOs at an index greater than 4, it can lead to an out-of-bounds access when the rdo index() is used to index into the src pdos array in ucsi psy get voltage now(). This can be resolved by retrieving and storing up to the maximum of 7 PDOs in the con->src pdos array, involving two calls to the GET PDOS command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-02855

CVE-2021-46980

OPENSUSE-SU-2024_1489-1

SUSE-SU-2024:1465-1

SUSE-SU-2024:1489-1

Affected Products

Linux Kernel

Suse

References · 348

• https://git.kernel.org/stable/c/e5366bea0277425e1868ba20eeb27c879d5a6e2d · Patch
• https://git.kernel.org/stable/c/1f4642b72be79757f050924a9b9673b6a02034bc · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46980 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1489-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46980 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46980 · Vendor Advisory
• https://git.kernel.org/stable/c/a453bfd7ef15fd9d524004d3ca7b05353a302911 · Patch
• https://git.kernel.org/stable/c/5e9c6f58b01e6fdfbc740390c01f542a35c97e57 · Patch
• https://bdu.fstec.ru/vul/2025-02855 · Security Note
• https://ubuntu.com/security/CVE-2021-46980 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1465-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46980 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-46980 · Vendor Advisory
• https://bugzilla.suse.com/1221990 · Note