cbcvebase.
CVE-2024-36950
published 2024-05-30

CVE-2024-36950: In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI…

PriorityP414medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.26%
17.7th percentile
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them. irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally. This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization. irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired. As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS ca

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.94-1 (bookworm)linux 6.1.94-1 (bookworm)
linuxlinux
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < b3948c69d60279fce5b2eeda92a07d66296c8130b3948c69d60279fce5b2eeda92a07d66296c8130
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 31279bbca40d2f40cb3bbb6d538ec9620a645dec31279bbca40d2f40cb3bbb6d538ec9620a645dec
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < fa273f312334246c909475c5868e6daab889cc8cfa273f312334246c909475c5868e6daab889cc8c
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 4f9cc355c328fc4f41cbd9c4cd58b235184fa4204f9cc355c328fc4f41cbd9c4cd58b235184fa420
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 6fafe3661712b143d9c69a7322294bd53f559d5d6fafe3661712b143d9c69a7322294bd53f559d5d
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 5982887de60c1b84f9c0ca07c835814d07fd1da05982887de60c1b84f9c0ca07c835814d07fd1da0
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 8643332aac0576581cfdf01798ea3e4e0d624b618643332aac0576581cfdf01798ea3e4e0d624b61
linuxlinux>= a007bb857e0b26f5d8b73c2ff90782d9c0972620 < 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9752e3c53de0fa3b7d817a83050b6699b8e9c6ec9
linuxlinux_kernel< 4.19.3144.19.314
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.218-15.10.218-1
linuxlinux_kernel>= 0 < 6.1.94-16.1.94-1
linuxlinux_kernel>= 0 < 6.8.11-16.8.11-1
linuxlinux_kernel>= 0 < 6.8.11-16.8.11-1
linuxlinux_kernel>= 0 < 5.4.0-192.2125.4.0-192.212
linuxlinux_kernel>= 0 < 5.15.0-118.1285.15.0-118.128
linuxlinux_kernel>= 0 < 6.8.0-40.406.8.0-40.40
linuxlinux_kernel>= 4.20 < 5.4.2765.4.276
linuxlinux_kernel>= 5.11 < 5.15.1595.15.159
linuxlinux_kernel>= 5.16 < 6.1.916.1.91
linuxlinux_kernel>= 5.5 < 5.10.2175.10.217
linuxlinux_kernel>= 6.2 < 6.6.316.6.31

CVSS provenance

nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.