CVE-2021-46980 is a vulnerability in the Linux kernel's USB Type-C subsystem, specifically within the USB Type-C Connector System Software Interface (UCSI) driver. The issue arises from improper handling of Power Data Objects (PDOs) during USB Power Delivery (PD) negotiations. The vulnerability was introduced in commit 4dbc6a4ef06d, which aimed to retrieve PDOs from a PD-capable power source. However, due to a limitation in the MESSAGE_IN length (16 bytes), only the first 4 PDOs were fetched, despite the PD specification allowing up to 7 PDOs. If a connected PD source advertises more than 4 PDOs and the Power Policy Manager (PPM) negotiates a power contract with a PDO beyond the fourth index, the driver attempts to access an out-of-bounds index in the src_pdos array. This results in an out-of-bounds memory access when the rdo_index() function indexes into src_pdos in the ucsi_psy_get_voltage_now() function. The vulnerability can cause kernel crashes, as evidenced by kernel BRK exceptions and internal errors in the call trace. The root cause is that the driver does not retrieve all PDOs in a single call, and the fix involves making multiple GET_PDOS calls to retrieve and store up to the maximum 7 PDOs allowed by the PD specification. This vulnerability can lead to kernel instability and potential denial of service (DoS) conditions when connecting to malicious or specially crafted PD power sources advertising more than 4 PDOs. Although no known exploits are reported in the wild, the vulnerability is significant due to its kernel-level impact and the ubiquity of Linux in various devices and systems.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions that interact with USB Type-C PD power sources. The impact includes potential kernel crashes leading to system instability or denial of service, which can disrupt critical operations, especially in environments relying on Linux-based infrastructure such as servers, embedded devices, and workstations. Organizations using Linux laptops or devices powered via USB Type-C PD adapters could experience unexpected reboots or failures if connected to malicious or misconfigured PD power sources. While the vulnerability does not directly lead to privilege escalation or data leakage, the resulting denial of service could impact availability of services and systems. In sectors like manufacturing, telecommunications, and critical infrastructure—where Linux is prevalent—this could translate to operational downtime. Additionally, the vulnerability could be exploited in targeted attacks where adversaries supply malicious PD power sources to cause disruption. Given the increasing adoption of USB Type-C in enterprise hardware, the threat surface is broad. However, the lack of known exploits and the requirement for physical connection to a malicious PD source somewhat limits remote exploitation, reducing the overall risk to remote or cloud-based systems.

To mitigate this vulnerability, European organizations should: 1) Ensure Linux systems are updated to kernel versions where this vulnerability is patched, specifically those that implement the fix to retrieve all PDOs via multiple GET_PDOS calls. 2) Implement strict hardware supply chain controls to prevent the introduction of malicious or non-compliant USB Type-C PD power sources, especially in sensitive environments. 3) Employ endpoint security solutions that monitor kernel stability and log unusual USB device behaviors to detect potential exploitation attempts. 4) For critical systems, consider disabling USB Type-C PD negotiation or restricting USB device connections where feasible. 5) Conduct regular audits of connected USB devices and power adapters to ensure compliance with PD specifications. 6) Engage with hardware vendors to verify that supplied USB Type-C power adapters conform to standards and do not advertise excessive PDOs beyond specification limits. These measures go beyond generic patching by addressing the physical and operational vectors that could be exploited.