CVE-2024-531507.1HighCWE-125

CVE-2024-53150: ALSA: usb-audio: Fix out of bounds reads when finding clock sources

Linux

Vendor fix available · Affected: Linux · Exploitation: in CISA KEV since 9 Apr 2025

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

ExploitationIn CISA KEV

In CISA KEVCISA KEV catalogue9 Apr 2025
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not established: not seen

1.4%probability of exploitation in the next 30 days

72nd percentile

050100

Higher than 72% of scored CVEs

7.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Linux · Linuxfrom 4.19.84 before 4.20; from 5.3.11 before 5.4
Linux · Linux5.4

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV: Listed since 9 Apr 2025 · catalogue entry
Public check: No public nuclei template
Weakness: Out-of-bounds Read · Memory Corruption
Vendor: Linux
Published: December 2024
Band: Exploited in the wild, December 2024

What changed

9 Apr 2025
CISA added it to the KEV catalogue CISA

CoverageNo articles yet

No CyberSIXT article names CVE-2024-53150 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.