SECUFOCUSNOW
Home›CVE index›CVE-2024-53150
CISA KEV · Known exploitedHigh

CVE-2024-53150

Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier...

CVSS
7.1
EPSS
1.35%
68.8% percentile
CISA KEV
Listed
Published
2024.12.24
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability1.35%
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier...

Affected product and versions

Product
Linux Kernel
Affected versions
b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a, 9feeaa50e5b4b0b71259d918a36ecf9059e60796, 3b17a13b687ae99939dc94a4ae01fbc34f68decc, 4.19.84, 5.3.11, 5.4, 11.0, < 5.4.287, >= 5.5 < 5.10.231, >= 5.11 < 5.15.174, >= 5.16 < 6.1.120, >= 6.2 < 6.6.64, >= 6.7 < 6.11.11, >= 6.12 < 6.12.2
Fixed versions
5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2025.04.30
  1. 1
    Identify

    Confirm that Linux Kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-125
KEV added
2025.04.09
Ransomware use
미확인
CVE-2024-53150 — Linux Kernel | SECUFOCUS NOW