7.8

CVE-2024-53203: linux Improper Validation of Array Index

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-53203DEBIAN-CVE-2024-53203
Published 27-12-2024Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2024-53203 is a high (CVSS 7.8) Improper Validation of Array Index vulnerability in linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 32 · Related 30
DLA-4271-1DLA-4327-1DSA-5925-1RHSA-2025:6966SUSE-SU-2025:0428-1SUSE-SU-2025:0499-1

Timeline

  1. 27-12-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu122 products
  • linux< 5.15.0-144.157 | < 6.8.0-58.60
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1088.95 | < 6.8.0-1027.29
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 627c2a5056aba42a8a96a8fffe8996aeccf919a9 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < e15fd96c0b701c53f9006bcc836eaeb35a05a023 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < e44189455c62469eb91d383ce9103d54c1f807a3 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 0e66fd8e5a2e45c7dacfc9178ba702153f4a61a8 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < ef92cd55289a282910575c5b9d87f646f2d39b38 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 56971710cd541f2f05160a84b3183477d34a1be9 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < e56aac6e5a25630645607b6856d4b2a17b2311a5 | 5.6
  • linux_kernel≥ 5.6, < 6.11.11 | ≥ 6.12, < 6.12.2
Debian1 product
  • linux< 6.1.140-1 | < 6.12.3-1

3 vendors · 125 products

References

36 links
Show all 36 references