CVE-2024-50205
ALSA Firewire Division by Zero Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table. Found by Linux Verification Center (linuxtesting.org) with SVACE.
INFO
Published Date :
Nov. 8, 2024, 6:15 a.m.
Last Modified :
Nov. 13, 2024, 5 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-50205.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-50205 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-50205 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 13, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/3452d39c4704aa12504e4190298c721fb01083c3 No Types Assigned https://git.kernel.org/stable/c/3452d39c4704aa12504e4190298c721fb01083c3 Patch Changed Reference Type https://git.kernel.org/stable/c/4bdc21506f12b2d432b1f2667e5ff4c75eee58e3 No Types Assigned https://git.kernel.org/stable/c/4bdc21506f12b2d432b1f2667e5ff4c75eee58e3 Patch Changed Reference Type https://git.kernel.org/stable/c/5e431f85c87bbffd93a9830d5a576586f9855291 No Types Assigned https://git.kernel.org/stable/c/5e431f85c87bbffd93a9830d5a576586f9855291 Patch Changed Reference Type https://git.kernel.org/stable/c/72cafe63b35d06b5cfbaf807e90ae657907858da No Types Assigned https://git.kernel.org/stable/c/72cafe63b35d06b5cfbaf807e90ae657907858da Patch Changed Reference Type https://git.kernel.org/stable/c/7d4eb9e22131ec154e638cbd56629195c9bcbe9a No Types Assigned https://git.kernel.org/stable/c/7d4eb9e22131ec154e638cbd56629195c9bcbe9a Patch Changed Reference Type https://git.kernel.org/stable/c/d2826873db70a6719cdd9212a6739f3e6234cfc4 No Types Assigned https://git.kernel.org/stable/c/d2826873db70a6719cdd9212a6739f3e6234cfc4 Patch Changed Reference Type https://git.kernel.org/stable/c/d575414361630b8b0523912532fcd7c79e43468c No Types Assigned https://git.kernel.org/stable/c/d575414361630b8b0523912532fcd7c79e43468c Patch Added CWE NIST CWE-369 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.285 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.229 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.170 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.115 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.59 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.6 *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 08, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/d575414361630b8b0523912532fcd7c79e43468c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5e431f85c87bbffd93a9830d5a576586f9855291 [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 08, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table. Found by Linux Verification Center (linuxtesting.org) with SVACE. Added Reference kernel.org https://git.kernel.org/stable/c/7d4eb9e22131ec154e638cbd56629195c9bcbe9a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d2826873db70a6719cdd9212a6739f3e6234cfc4 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4bdc21506f12b2d432b1f2667e5ff4c75eee58e3 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/3452d39c4704aa12504e4190298c721fb01083c3 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/72cafe63b35d06b5cfbaf807e90ae657907858da [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-50205 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-50205
weaknesses.