CVE-2024-50113

CVE-2024-50113

High · published November 5, 2024

CVSS v3.1
8.8
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix invalid port index for parent device

In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self

ID sequence"), the enumeration over self ID sequence was refactored with

some helper functions with KUnit tests. These helper functions are

guaranteed to work expectedly by the KUnit tests, however their application

includes a mistake to assign invalid value to the index of port connected

to parent device.

This bug affects the case that any extra node devices which has three or

more ports are connected to 1394 OHCI controller. In the case, the path

to update the tree cache could hits WARN_ON(), and gets general protection

fault due to the access to invalid address computed by the invalid value.

This commit fixes the bug to assign correct port index.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Published
2024-11-05T23:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.11, < 6.11.66.11.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 05 NOV 17:10Z
    firewire: core: fix invalid port index for parent device
    cvelistv5