Security readout for executives and security teams
Plain-English summary
A Linux AMD Sensor Fusion Hub driver cleanup flaw can leave memory improperly managed when device initialization fails. Reported consequences include memory errors, page faults, Btrfs becoming read-only, and disk corruption. This can threaten system availability and data integrity, but the supplied sources do not establish widespread exposure or exploitation.
Executive priority
Treat this as a high-priority reliability and data-integrity issue on potentially affected AMD Linux endpoints, especially Btrfs systems. Accelerate inventory and vendor-kernel updates where driver use or related errors are confirmed. It does not currently justify an emergency response based on exploitation evidence alone.
Technical view
The amd_sfh HID driver used non-device-managed coherent memory allocation, creating improper cleanup in the probe error path. Linux resolved this by switching to dmam_alloc_coherent(), which ties cleanup to the device lifecycle. CVSS 3.1 is 7.8 with local access and low privileges required; confidentiality, integrity, and availability impacts are rated high.
Likely exposure
Exposure is most plausible on Linux systems using the AMD SFH driver where device probing can enter the affected error path. The bundle flags versions 5.11, 5.15.168, 6.1.113, 6.6.57, 6.11.4, and 6.12, but its flattened version data is ambiguous; distribution backports require vendor-specific verification.
Exploitation context
The supplied record is not in KEV, and no cited source reports active exploitation. The CVSS vector describes a local, low-privileged attack context with no user interaction. However, the sources do not explain a reliable attacker-controlled trigger, so intentional exploitation and practical reach remain unconfirmed.
Researcher notes
The source describes a probe-error cleanup defect corrected through device-managed coherent allocation. It does not identify a CWE, demonstrate attacker influence over the failing path, or document proof-of-concept exploitation. Commit-level analysis and distribution patch mapping are needed because the supplied affected-version representation lacks clear range semantics.
Mitigation direction
- Install a vendor-supported kernel containing the applicable amd_sfh fix or distribution backport.
- Check Linux distribution security guidance to map packaged kernels to the listed upstream fix commits.
- Prioritize systems showing AMD SFH initialization failures, page faults, or unexpected Btrfs read-only transitions.
- Back up important data before remediation where filesystem corruption indicators are present.
Validation and detection
- Inventory kernel versions and determine whether AMD SFH support is present and active.
- Compare the running distribution kernel against vendor advisories and backported fix records.
- Review system logs for amd_sfh probe failures, memory errors, page faults, and Btrfs warnings.
- After updating, confirm the fixed kernel is running and monitor for recurrence of storage errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-50189 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8c6ad37e5882073cab84901a31da9cb22f316276CVE reference, Linux
- https://git.kernel.org/stable/c/4cd9c5a0fcadc39a05c978a01e15e0d1edc4be93CVE reference, Linux
- https://git.kernel.org/stable/c/1c3b4c90479aa0375ec98fe1a802993ff96a5f47CVE reference, Linux
- https://git.kernel.org/stable/c/9dfee956f53eea96d93ef1e13ab4ce020f4c58b3CVE reference, Linux
- https://git.kernel.org/stable/c/c56f9ecb7fb6a3a90079c19eb4c8daf3bbf514b3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.