60
CVE-2024-53150
KEVmass1Out-of-Bounds Read in Linux Kernel ALSA USB Audio Driver
CISA: Linux Kernel Out-of-Bounds Read Vulnerability
CVSS 3.1
7.1 high
EPSS
1%p70
Published
()
KEV added
AI analysis
CVE-2024-53150 is an out-of-bounds read (CWE-125) in the Linux kernel's ALSA USB-audio driver, which fails to validate the bLength field of USB audio class (UAC2/UAC3) clock source, selector, and multiplier descriptors while traversing them. It is triggered when a device presents a malformed/bogus clock descriptor with a bLength shorter than expected, causing the kernel to read beyond the descriptor buffer; an attacker with local access (e.g., by plugging in a malicious USB audio device) could gain partial kernel memory disclosure or crash the system (CVSS 3.1: 7.1, confidentiality high, availability high). Any Linux deployment whose kernel includes the affected ALSA USB-audio clock-source handling is affected, including Debian releases shipping such kernels. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-04-09, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware association is unconfirmed.
What to do: Apply updated kernel packages from your distribution (e.g., Debian security updates) that include the ALSA USB-audio clock descriptor validation fix, and reboot to load the patched kernel; CISA KEV requires applying vendor mitigations per BOD 22-01 timelines or discontinuing use if mitigations are unavailable. Until patched, restrict untrusted physical/hotplug access to USB ports on affected systems. Check your current kernel version and confirm with the vendor that the clock-source descriptor sanity-check patch is included.
Affected
| Linux kernel (ALSA USB-audio subsystem) | — |
| Debian Linux | — |
Estimated exposure
masshundreds of millions of Linux systems potentially affected (Linux ubiquity), though only those where USB audio devices can be connected are practically… — Linux's dominant share across servers, embedded devices, and Debian's very large installed base puts the kernel's footprint in the hundreds of millions, but the local USB-attack-vector scope limits practical exposure to systems allowing…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
CISA Known Exploited Vulnerability
- Affected
- Linux Kernel
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
In the news7 stories
U.S. CISA adds SonicWall SMA100 Appliance flaw to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
60
Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities
60
Google Releases April Android Update to Address Two Zero
60
Google fixed two actively exploited Android zero
60
60