CVE-2024-50205 — CVE & Security Advisory Radar

🎯 CVE-2024-50205 MEDIUM 5.5 🔥 EPSS 23% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2024-50205 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show t

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()

The step variable is initialized to zero. It is changed in the loop,
but if it's not changed it will remain zero. Add a variable check
before the division.

The observed behavior was introduced by commit 826b5de90c0b
("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"),
and it is difficult to show that any of the interval parameters will
satisfy the snd_interval_test() condition with data from the
amdtp_rate_table[] table.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Klassifikation & Betroffenheit:

Linux Linux 826b5de90c0bca4e9de6231da9e1730480621588 <d575414361630b8b0523912532fcd7c79e43468cLinux 826b5de90c0bca4e9de6231da9e1730480621588 <7d4eb9e22131ec154e638cbd56629195c9bcbe9aLinux patch: 6.1.115Linux patch: 6.12Linux patch: 5.10.229Linux 826b5de90c0bca4e9de6231da9e1730480621588 <72cafe63b35d06b5cfbaf807e90ae657907858daLinux patch: 5.15.170Linux 826b5de90c0bca4e9de6231da9e1730480621588 <4bdc21506f12b2d432b1f2667e5ff4c75eee58e3

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-64587 7.0 CVE-2026-64510 7.0 CVE-2026-64460 7.0 CVE-2026-64420 7.0 CVE-2026-64413 7.0

🩹 Patch verfügbar (OSV):

🩹 Kernel ≥ 5.4.285 🩹 Kernel ≥ 5.10.229 🩹 Kernel ≥ 5.15.170 🩹 Kernel ≥ 6.1.115 🩹 Kernel ≥ 6.6.59 🩹 Kernel ≥ 6.11.6

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 11/2024

Heute 11.09.

CVSS-Vektor-Analyse: 5.5

AV · Angriffsvektor Lokal

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Keine

I · Integrität Keine

A · Verfügbarkeit Hoch

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Veröffentlicht:08.11.2024

Aktualisiert:17.06.2026 08:03

Assigner (CNA):Linux

EUVD-ID:EUVD-2024-44707

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

Tier	2026-08-29	2026-09-11
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

5.5 MEDIUM

🇪🇺 EUVD

EPSS

23%

CVE-2024-50205 💻 Lokal 🔑 Geringe Nutzerrechte nötig

Linux

CVE-2024-50205 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show t

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

08.11.2024

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub