Google addresses 2 actively exploited vulnerabilities in security update

CVE-2024-53150 is an out-of-bounds read (CWE-125) in the Linux kernel's ALSA USB-audio driver, which fails to validate the bLength field of USB audio class (UAC2/UAC3) clock source, selector, and multiplier descriptors while traversing them. It is triggered when a device presents a malformed/bogus clock descriptor with a bLength shorter than expected, causing the kernel to read beyond the descriptor buffer; an attacker with local access (e.g., by plugging in a malicious USB audio device) could gain partial kernel memory disclosure or crash the system (CVSS 3.1: 7.1, confidentiality high, availability high). Any Linux deployment whose kernel includes the affected ALSA USB-audio clock-source handling is affected, including Debian releases shipping such kernels. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-04-09, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware association is unconfirmed.

Do: Apply updated kernel packages from your distribution (e.g., Debian security updates) that include the ALSA USB-audio clock descriptor validation fix, and reboot to load the patched kernel; CISA KEV requires applying vendor mitigations per BOD 22-01 timelines or discontinuing use if mitigations are unavailable. Until patched, restrict untrusted physical/hotplug access to USB ports on affected systems. Check your current kernel version and confirm with the vendor that the clock-source descriptor sanity-check patch is included.

CVE-2024-53197 is an out-of-bounds access/write (CWE-787) in the Linux kernel's USB configuration handling, tied to the ALSA usb-audio driver's handling of Creative Extigy and Mbox devices. A malicious or bogus USB device that reports a bNumConfigurations value larger than the array allocated by usb_get_configuration causes the kernel to access memory beyond the end of dev->config, for example in usb_destroy_configuration. An attacker with local access — or the ability to plug a crafted USB audio device into a target — could corrupt or disclose kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 7.8, local vector), typically as privilege escalation or a kernel crash. Any Linux deployment running a kernel with the vulnerable code is affected, including Debian systems. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-09, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Update the Linux kernel to a vendor release containing the CVE-2024-53197 fix — for Debian, install the current kernel security update and reboot; other distributions ship the patched kernel in their stable updates. Because exploitation requires a malicious USB audio device, restrict use of untrusted USB peripherals on sensitive or internet-adjacent hosts. Organizations subject to CISA BOD 22-01 must remediate this KEV-listed flaw per the required actions or discontinue use where mitigations are unavailable.