CVE-2024-50113
Description
A flaw was found in the Linux kernel's firewire core. A local attacker, by connecting a specially crafted FireWire (IEEE 1394) device with three or more ports to a 1394 OHCI controller, could trigger an invalid port index assignment. This mistake in handling self-ID sequences leads to an access to an invalid memory address, resulting in a general protection fault and a system crash. This vulnerability could lead to a Denial of Service.
Mitigation
To prevent this Moderate impact flaw, blacklist the `firewire_core` kernel module. Create a file `/etc/modprobe.d/disable-firewire.conf` with the content `install firewire_core /bin/true`. Regenerate the initramfs using `dracut -f -v` and reboot the system for the changes to take effect. This action will disable all FireWire functionality.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 8.8 |
| Attack Vector | Local | Local | Adjacent Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data; Read Files or Directories; Modify Files or Directories
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
