CVE-2024-50113
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
05/11/2024
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
firewire: core: fix invalid port index for parent device<br />
<br />
In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self<br />
ID sequence"), the enumeration over self ID sequence was refactored with<br />
some helper functions with KUnit tests. These helper functions are<br />
guaranteed to work expectedly by the KUnit tests, however their application<br />
includes a mistake to assign invalid value to the index of port connected<br />
to parent device.<br />
<br />
This bug affects the case that any extra node devices which has three or<br />
more ports are connected to 1394 OHCI controller. In the case, the path<br />
to update the tree cache could hits WARN_ON(), and gets general protection<br />
fault due to the access to invalid address computed by the invalid value.<br />
<br />
This commit fixes the bug to assign correct port index.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



