CVE-2024-50113

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix invalid port index for parent device

In a commit 24b7f8e5cd65 ("firewire: core: use helper functions for self

ID sequence"), the enumeration over self ID sequence was refactored with

some helper functions with KUnit tests. These helper functions are

guaranteed to work expectedly by the KUnit tests, however their application

includes a mistake to assign invalid value to the index of port connected

to parent device.

This bug affects the case that any extra node devices which has three or

more ports are connected to 1394 OHCI controller. In the case, the path

to update the tree cache could hits WARN_ON(), and gets general protection

fault due to the access to invalid address computed by the invalid value.

This commit fixes the bug to assign correct port index.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References