🛡️ CVE-2024-50007 — debian-linux

🟠 CVSS 7.8 — High ✅ No Known Exploit CWE-129 NVD

7.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

ALSA: asihpi: Fix potential OOB array access

In the Linux kernel, the following vulnerability has been resolved:

ALSA: asihpi: Fix potential OOB array access

ASIHPI driver stores some values in the static array upon a response

from the driver, and its index depends on the firmware. We shouldn't

trust it blindly.

This patch adds a sanity check of the array index to fit in the array

size.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Weakness class

CVE-2024-50007 is classified as CWE-129: Improper Validation of Array Index. An index derived from input is used without a range check, so the access lands outside the array.

Affected software

CVE-2024-50007 is recorded against 3 packages.

debian-linux
kernel (from 6.11.0 up to 6.11.3)
linux-kernel (from 6.11 up to 6.11.3)

Timeline and source

Published on 21 October 2024 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
lists.debian.org
lists.debian.org

CVE-2024-50007 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

BellSoft Debian Ubuntu

Details

Severity HIGH

CVSS Score 7.8

CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE CWE-129

Public Exploit ✅ No

Source NVD

Published 2024-10-21

Updated 2026-08-12

Modified 2026-06-17

Fix URL https://git.kernel.org/stable/c/219587bca2678e31700ef09ecec178ba1f735674

Affected Packages

Software	From version	Fixed in
debian-linux	—	—
kernel	6.11.0	6.11.3
linux-kernel	6.11	6.11.3

References

Patch https://git.kernel.org/stable/c/219587bca2678e31700ef09ecec178ba1f735674

Patch https://git.kernel.org/stable/c/36ee4021bcc37b834996e79740d095d6f8dd948f

Patch https://git.kernel.org/stable/c/7a55740996701f7b2bc46dc988b60ef2e416a747

Patch https://git.kernel.org/stable/c/7b986c7430a6bb68d523dac7bfc74cbd5b44ef96

Patch https://git.kernel.org/stable/c/876d04bf5a8ac1d6af5afd258cd37ab83ab2cf3d

Patch https://git.kernel.org/stable/c/a6bdb691cf7b66dcd929de1a253c5c42edd2e522

Patch https://git.kernel.org/stable/c/ad7248a5e92587b9266c62db8bcc4e58de53e372

Patch https://git.kernel.org/stable/c/ce2953e44829ec54bcbb57e9d890fc8af0900c80

Patch https://git.kernel.org/stable/c/e658227d9d4f4e122d81690fdbc0d438b10288f5

Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

Site Security Check

Is debian-linux part of your stack?

CVE-2024-50007 is rated CVSS 7.8 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.