CVE-2024-50205

What it actually does

Missing bounds check allows step variable to remain zero, leading to division by zero in apply_constraint_to_size() during PCM period/buffer size constraint application in ALSA firewire-lib.

Why it matters to the business

Local authenticated users can trigger a kernel crash or hang on systems using FireWire audio devices, causing denial of service and loss of audio functionality until reboot.

How an attack unfolds

An attacker with local access crafts specific PCM interval parameters that fail snd_interval_test() against amdtp_rate_table data, leaving step at zero and causing division by zero during constraint application.

How to fix it

Update to Linux kernel commit d575414361630b8b0523912532fcd7c79e43468c or later; for affected packages apply fixes such as libgwenhywfar 4.15.2beta-2build1 or newer where available.

How to confirm the fix worked

Confirm kernel source contains the added step variable check before division in apply_constraint_to_size(); test with SVACE or similar static analysis and verify no division-by-zero paths remain.

Typical attack path

1. Obtain local shell or user access on affected Linux system
2. Load or trigger ALSA firewire-lib PCM device usage
3. Supply crafted period or buffer size parameters via snd_pcm_hw_params
4. Trigger division by zero resulting in kernel panic or oops

How to detect it

Review kernel logs for division-by-zero oops or panic traces mentioning apply_constraint_to_size or firewire-lib; inspect audit logs for unusual ALSA PCM parameter calls from untrusted users.

What your security team should do

• Prioritize kernel upgrade on systems exposing FireWire audio interfaces
• Restrict local user access to audio devices until patched
• Monitor for kernel oops or panic logs related to firewire-lib
• Apply updates within standard change windows given low EPSS and no KEV listing