CVE-2024-50113 (GCVE-0-2024-50113)

Vulnerability from cvelistv5 – Published: 2024-11-05 17:10 – Updated: 2026-08-05 11:41
VLAI
Title
firewire: core: fix invalid port index for parent device
Summary
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix invalid port index for parent device In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self ID sequence"), the enumeration over self ID sequence was refactored with some helper functions with KUnit tests. These helper functions are guaranteed to work expectedly by the KUnit tests, however their application includes a mistake to assign invalid value to the index of port connected to parent device. This bug affects the case that any extra node devices which has three or more ports are connected to 1394 OHCI controller. In the case, the path to update the tree cache could hits WARN_ON(), and gets general protection fault due to the access to invalid address computed by the invalid value. This commit fixes the bug to assign correct port index.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 24b7f8e5cd656196a13077e160aec45ad89b58d9 , < 90753a38bc3d058820981f812a908a99f7b337c1 (git)
Affected: 24b7f8e5cd656196a13077e160aec45ad89b58d9 , < f6a6780e0b9bbcf311a727afed06fee533a5e957 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:21:59.175178Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:17.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firewire/core-topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90753a38bc3d058820981f812a908a99f7b337c1",
              "status": "affected",
              "version": "24b7f8e5cd656196a13077e160aec45ad89b58d9",
              "versionType": "git"
            },
            {
              "lessThan": "f6a6780e0b9bbcf311a727afed06fee533a5e957",
              "status": "affected",
              "version": "24b7f8e5cd656196a13077e160aec45ad89b58d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firewire/core-topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: core: fix invalid port index for parent device\n\nIn a commit 24b7f8e5cd65 (\"firewire: core: use helper functions for self\nID sequence\"), the enumeration over self ID sequence was refactored with\nsome helper functions with KUnit tests. These helper functions are\nguaranteed to work expectedly by the KUnit tests, however their application\nincludes a mistake to assign invalid value to the index of port connected\nto parent device.\n\nThis bug affects the case that any extra node devices which has three or\nmore ports are connected to 1394 OHCI controller. In the case, the path\nto update the tree cache could hits WARN_ON(), and gets general protection\nfault due to the access to invalid address computed by the invalid value.\n\nThis commit fixes the bug to assign correct port index."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The trigger data is the self-ID packet sequence emitted by PHYs on the IEEE 1394 bus, processed unconditionally in the OHCI bus-reset bottom half; an attacker-controlled node anywhere on the shared 1394 bus (up to 63 nodes, reachable through hubs/repeaters without touching the victim machine) supplies it, which is the same shared-physical-segment model as Bluetooth/WiFi and matches this CNA\u0027s scoring of analogous Thunderbolt/HID attached-device bugs.\nAC:L - The attacker fully controls the preconditions \u2014 attaching or emulating a node with three or more ports and forcing bus resets (any 1394 node can initiate one, and unplug/replug works too) \u2014 so the malformed topology is produced deterministically and repeatably; the reporter hit it with ordinary off-the-shelf hardware.\nPR:N - No credentials, account, or local access are required: fw_core_handle_bus_reset() -\u003e build_tree() -\u003e update_tree() runs automatically from the OHCI interrupt bottom half on every bus reset, with no capability check or authentication gate anywhere on the path.\nUI:N - Nothing is required of a victim user \u2014 the self-ID sequence is parsed automatically by the kernel on bus reset, and the device attachment/reset is the attacker\u0027s own action rather than a victim action.\nS:U - The corruption is confined to kernel heap objects (struct fw_node) managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed by the topology parser.\nC:H - The desynchronized walk in update_tree() reads node1-\u003eports[i] beyond the __counted_by(port_count) flexible array, disclosing adjacent kernel heap contents as pointers, and the premature fw_node_put()/report_lost_node() path yields use-after-free of fw_node objects in a general-purpose slab cache, which an attacker can groom for arbitrary kernel memory read.\nI:H - The out-of-bounds-derived pointer is written through \u2014 move_tree() performs tree-\u003eports[i] = node0 and list_add_tail() writes list prev/next pointers into the bogus address \u2014 giving a kernel-pointer write primitive at an attacker-influenced offset, and the use-after-free on fw_node allows reclaiming and controlling freed object contents for control-flow hijacking.\nA:H - The commit explicitly reports WARN_ON() followed by a general protection fault from dereferencing the invalid address, and the accompanying use-after-free/list corruption reliably panics the machine; an attacker on the bus can repeat bus resets to crash it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:43.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90753a38bc3d058820981f812a908a99f7b337c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6a6780e0b9bbcf311a727afed06fee533a5e957"
        }
      ],
      "title": "firewire: core: fix invalid port index for parent device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50113",
    "datePublished": "2024-11-05T17:10:45.333Z",
    "dateReserved": "2024-10-21T19:36:19.947Z",
    "dateUpdated": "2026-08-05T11:41:43.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50113",
      "date": "2026-08-09",
      "epss": "0.00295",
      "percentile": "0.21794"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.6\", \"matchCriteriaId\": \"35973F0F-C32F-4D88-B0FE-C75F65A0002B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirewire: core: fix invalid port index for parent device\\n\\nIn a commit 24b7f8e5cd65 (\\\"firewire: core: use helper functions for self\\nID sequence\\\"), the enumeration over self ID sequence was refactored with\\nsome helper functions with KUnit tests. These helper functions are\\nguaranteed to work expectedly by the KUnit tests, however their application\\nincludes a mistake to assign invalid value to the index of port connected\\nto parent device.\\n\\nThis bug affects the case that any extra node devices which has three or\\nmore ports are connected to 1394 OHCI controller. In the case, the path\\nto update the tree cache could hits WARN_ON(), and gets general protection\\nfault due to the access to invalid address computed by the invalid value.\\n\\nThis commit fixes the bug to assign correct port index.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firewire: core: fix invalid port index for parent device En una confirmaci\\u00f3n 24b7f8e5cd65 (\\\"firewire: core: use helper functions for self ID sequence\\\"), la enumeraci\\u00f3n sobre la secuencia de auto-identificaci\\u00f3n se refactoriz\\u00f3 con algunas funciones auxiliares con pruebas KUnit. Se garantiza que estas funciones auxiliares funcionar\\u00e1n como se espera mediante las pruebas KUnit, sin embargo, su aplicaci\\u00f3n incluye un error para asignar un valor no v\\u00e1lido al \\u00edndice del puerto conectado al dispositivo principal. Este error afecta al caso en que cualquier dispositivo de nodo adicional que tenga tres o m\\u00e1s puertos est\\u00e9 conectado al controlador 1394 OHCI. En el caso, la ruta para actualizar la cach\\u00e9 del \\u00e1rbol podr\\u00eda alcanzar WARN_ON() y obtener un fallo de protecci\\u00f3n general debido al acceso a una direcci\\u00f3n no v\\u00e1lida calculada por el valor no v\\u00e1lido. Esta confirmaci\\u00f3n corrige el error para asignar el \\u00edndice de puerto correcto.\"}]",
      "id": "CVE-2024-50113",
      "lastModified": "2024-11-08T20:37:04.953",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-05T18:15:14.560",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/90753a38bc3d058820981f812a908a99f7b337c1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f6a6780e0b9bbcf311a727afed06fee533a5e957\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50113\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-05T18:15:14.560\",\"lastModified\":\"2026-08-04T11:21:20.680\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirewire: core: fix invalid port index for parent device\\n\\nIn a commit 24b7f8e5cd65 (\\\"firewire: core: use helper functions for self\\nID sequence\\\"), the enumeration over self ID sequence was refactored with\\nsome helper functions with KUnit tests. These helper functions are\\nguaranteed to work expectedly by the KUnit tests, however their application\\nincludes a mistake to assign invalid value to the index of port connected\\nto parent device.\\n\\nThis bug affects the case that any extra node devices which has three or\\nmore ports are connected to 1394 OHCI controller. In the case, the path\\nto update the tree cache could hits WARN_ON(), and gets general protection\\nfault due to the access to invalid address computed by the invalid value.\\n\\nThis commit fixes the bug to assign correct port index.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firewire: core: fix invalid port index for parent device En una confirmaci\u00f3n 24b7f8e5cd65 (\\\"firewire: core: use helper functions for self ID sequence\\\"), la enumeraci\u00f3n sobre la secuencia de auto-identificaci\u00f3n se refactoriz\u00f3 con algunas funciones auxiliares con pruebas KUnit. Se garantiza que estas funciones auxiliares funcionar\u00e1n como se espera mediante las pruebas KUnit, sin embargo, su aplicaci\u00f3n incluye un error para asignar un valor no v\u00e1lido al \u00edndice del puerto conectado al dispositivo principal. Este error afecta al caso en que cualquier dispositivo de nodo adicional que tenga tres o m\u00e1s puertos est\u00e9 conectado al controlador 1394 OHCI. En el caso, la ruta para actualizar la cach\u00e9 del \u00e1rbol podr\u00eda alcanzar WARN_ON() y obtener un fallo de protecci\u00f3n general debido al acceso a una direcci\u00f3n no v\u00e1lida calculada por el valor no v\u00e1lido. Esta confirmaci\u00f3n corrige el error para asignar el \u00edndice de puerto correcto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/firewire/core-topology.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"24b7f8e5cd656196a13077e160aec45ad89b58d9\",\"lessThan\":\"90753a38bc3d058820981f812a908a99f7b337c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"24b7f8e5cd656196a13077e160aec45ad89b58d9\",\"lessThan\":\"f6a6780e0b9bbcf311a727afed06fee533a5e957\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/firewire/core-topology.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:21:59.175178Z\",\"id\":\"CVE-2024-50113\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"35973F0F-C32F-4D88-B0FE-C75F65A0002B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/90753a38bc3d058820981f812a908a99f7b337c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6a6780e0b9bbcf311a727afed06fee533a5e957\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:48:11+00:00",
      "cve": "CVE-2024-50113",
      "id": "CVE-2024-50113",
      "initial_release_date": "2024-11-05T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firewire: core: fix invalid port index for parent device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50113.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T01:56:51Z",
      "cve": "CVE-2024-50113",
      "id": "CVE-2024-50113",
      "initial_release_date": "2024-11-06T03:49:00Z",
      "product_status:known_not_affected": "370",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50113",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50113.json",
      "version": "24"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50113\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:21:59.175178Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:15:49.797Z\"}}], \"cna\": {\"title\": \"firewire: core: fix invalid port index for parent device\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The trigger data is the self-ID packet sequence emitted by PHYs on the IEEE 1394 bus, processed unconditionally in the OHCI bus-reset bottom half; an attacker-controlled node anywhere on the shared 1394 bus (up to 63 nodes, reachable through hubs/repeaters without touching the victim machine) supplies it, which is the same shared-physical-segment model as Bluetooth/WiFi and matches this CNA\u0027s scoring of analogous Thunderbolt/HID attached-device bugs.\\nAC:L - The attacker fully controls the preconditions \\u2014 attaching or emulating a node with three or more ports and forcing bus resets (any 1394 node can initiate one, and unplug/replug works too) \\u2014 so the malformed topology is produced deterministically and repeatably; the reporter hit it with ordinary off-the-shelf hardware.\\nPR:N - No credentials, account, or local access are required: fw_core_handle_bus_reset() -\u003e build_tree() -\u003e update_tree() runs automatically from the OHCI interrupt bottom half on every bus reset, with no capability check or authentication gate anywhere on the path.\\nUI:N - Nothing is required of a victim user \\u2014 the self-ID sequence is parsed automatically by the kernel on bus reset, and the device attachment/reset is the attacker\u0027s own action rather than a victim action.\\nS:U - The corruption is confined to kernel heap objects (struct fw_node) managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed by the topology parser.\\nC:H - The desynchronized walk in update_tree() reads node1-\u003eports[i] beyond the __counted_by(port_count) flexible array, disclosing adjacent kernel heap contents as pointers, and the premature fw_node_put()/report_lost_node() path yields use-after-free of fw_node objects in a general-purpose slab cache, which an attacker can groom for arbitrary kernel memory read.\\nI:H - The out-of-bounds-derived pointer is written through \\u2014 move_tree() performs tree-\u003eports[i] = node0 and list_add_tail() writes list prev/next pointers into the bogus address \\u2014 giving a kernel-pointer write primitive at an attacker-influenced offset, and the use-after-free on fw_node allows reclaiming and controlling freed object contents for control-flow hijacking.\\nA:H - The commit explicitly reports WARN_ON() followed by a general protection fault from dereferencing the invalid address, and the accompanying use-after-free/list corruption reliably panics the machine; an attacker on the bus can repeat bus resets to crash it at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"24b7f8e5cd656196a13077e160aec45ad89b58d9\", \"lessThan\": \"90753a38bc3d058820981f812a908a99f7b337c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"24b7f8e5cd656196a13077e160aec45ad89b58d9\", \"lessThan\": \"f6a6780e0b9bbcf311a727afed06fee533a5e957\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firewire/core-topology.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firewire/core-topology.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/90753a38bc3d058820981f812a908a99f7b337c1\"}, {\"url\": \"https://git.kernel.org/stable/c/f6a6780e0b9bbcf311a727afed06fee533a5e957\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirewire: core: fix invalid port index for parent device\\n\\nIn a commit 24b7f8e5cd65 (\\\"firewire: core: use helper functions for self\\nID sequence\\\"), the enumeration over self ID sequence was refactored with\\nsome helper functions with KUnit tests. These helper functions are\\nguaranteed to work expectedly by the KUnit tests, however their application\\nincludes a mistake to assign invalid value to the index of port connected\\nto parent device.\\n\\nThis bug affects the case that any extra node devices which has three or\\nmore ports are connected to 1394 OHCI controller. In the case, the path\\nto update the tree cache could hits WARN_ON(), and gets general protection\\nfault due to the access to invalid address computed by the invalid value.\\n\\nThis commit fixes the bug to assign correct port index.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:41:43.500Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50113\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:41:43.500Z\", \"dateReserved\": \"2024-10-21T19:36:19.947Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-05T17:10:45.333Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.