CVE-2024-50205

5.5 · MEDIUM

Published Nov 8, 2024 linux CWE-369 EPSS 0.23% (14th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-50205 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 8, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()

The step variable is initialized to zero. It is changed in the loop,

but if it's not changed it will remain zero. Add a variable check

before the division.

The observed behavior was introduced by commit 826b5de90c0b

("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"),

and it is difficult to show that any of the interval parameters will

satisfy the snd_interval_test() condition with data from the

amdtp_rate_table[] table.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 4.20, < 5.4.285	Affected

References

Ref git.kernel.org/stable/c/3452d39c4704aa12504e4190298c721fb01083c3 Ref git.kernel.org/stable/c/4bdc21506f12b2d432b1f2667e5ff4c75eee58e3 Ref git.kernel.org/stable/c/5e431f85c87bbffd93a9830d5a576586f9855291 Ref git.kernel.org/stable/c/72cafe63b35d06b5cfbaf807e90ae657907858da Ref git.kernel.org/stable/c/7d4eb9e22131ec154e638cbd56629195c9bcbe9a Ref git.kernel.org/stable/c/d2826873db70a6719cdd9212a6739f3e6234cfc4 Ref git.kernel.org/stable/c/d575414361630b8b0523912532fcd7c79e43468c Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html Ref cert-portal.siemens.com/productcert/html/ssa-265688.html

Frequently Asked Questions

What is CVE-2024-50205?

CVE-2024-50205 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 8, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-50205?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-50205?

How can CyberStrike help with CVE-2024-50205?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-50205 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719