Critical Vulnerability in Linux Package: Firewire Port Index Assignment Issue
Summary
DEBIAN-CVE-2024-50113: In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix invalid port index for parent device In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self ID sequence"), the enu... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is known for its stability and performance. However, it is susceptible to vulnerabilities that can affect system integrity and security. This specific issue relates to the Firewire subsystem, which manages connections to devices using the IEEE 1394 standard.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Firewire core that involves an incorrect assignment of the port index for parent devices. This issue originated from a code refactor in commit 24b7f8e5cd65, which introduced helper functions for handling self ID sequences. The mistake leads to the assignment of an invalid value to the port index when extra node devices with three or more ports are connected to a 1394 OHCI controller. As a result, this can trigger a WARN_ON() condition and potentially cause a general protection fault due to access to an invalid memory address.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks.
Conclusion
The vulnerability in the Linux package related to the Firewire subsystem poses significant risks to system stability and security. Users are urged to update to the patched version as soon as possible to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an incorrect assignment of the port index in the Firewire subsystem, which can lead to system crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include system instability, crashes, and potential data loss due to general protection faults.
Yes, a patch is available in version 6.11.6-1 of the Linux package.
It is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
