# CVE-2024-36950: firewire: ohci: mask bus reset interrupts between ISR and bottom half > A local attacker with debug access can cause a system freeze in the Linux kernel FireWire driver by triggering unmasked bus reset interrupts. - **Severity:** Medium 4.4 (`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** An administrator - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 30 May 2024 - **Updated:** 11 May 2026 - **Also known as:** BELL-CVE-2024-36950, DEBIAN-CVE-2024-36950, UBUNTU-CVE-2024-36950 ## What is CVE-2024-36950? CVE-2024-36950 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 30 May 2024. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them. irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally. This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization. irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired. As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed. ## Which versions are affected by CVE-2024-36950? It affects 2 products. Products: Debian Debian Linux, Linux kernel. ## How do I fix CVE-2024-36950? Apply the vendor's patch. ## Is CVE-2024-36950 being exploited? There is no known exploitation of CVE-2024-36950 in the wild and no public exploit code. ## Other vulnerabilities in Debian Debian Linux - [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild) - [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild) - [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild) - [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2024-36950 and fix it if it is affected. What it is: CVE-2024-36950 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 30 May 2024. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2024-36950 in the wild and no public exploit code. Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2024-36950/ (Markdown: https://insights.sbomify.com/CVE-2024-36950/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2024-36950 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36950 - OSV: https://osv.dev/vulnerability/CVE-2024-36950 --- From sbomify Insights: https://insights.sbomify.com/CVE-2024-36950/ Summaries are generated and may contain mistakes; the official description above is the record.