Skip to content
Log inStart free trial

CVE-2024-53150 A-382239029 ASB-A-382239029

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

High Known exploited Linux
Severity
7.1 / 10
High · CVSS 3.1
Exploit chance (EPSS)
1.35%
Chance of exploitation in the next 30 days. Higher than 71.59% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Apr 9, 2025
Weakness
CWE-125 Out-of-bounds Read
Fix
6.12.2
Upgrade Kernel to this version or later
Exploited in the wild. Linux Kernel Out-of-Bounds Read Vulnerability (Linux Kernel). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Apr 30, 2025.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

Affected versions

Linux

PackageVulnerableFixed in
Kernel
>= 5.4.0, < 5.4.287
>= 5.5.0, < 5.10.231
>= 5.11.0, < 5.15.174
>= 5.16.0, < 6.1.120
>= 6.2.0, < 6.6.64
>= 6.7.0, < 6.11.11
>= 6.12.0, < 6.12.2
5.4.287
5.10.231
5.15.174
6.1.120
6.6.64
6.11.11
6.12.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

Kernel Linux → 6.12.2

Set Kernel to 6.12.2 or later in your manifest.

Severity breakdown

CVSS 3.1 7.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Weakness

CWE-125: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How to prevent it
  • Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
  • Architecture and Design: Use a language that provides appropriate memory abstractions.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
High Known exploited Also affects Kernel
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
High Known exploited Also affects Kernel
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
High Known exploited Also affects Kernel
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
High Known exploited Also affects Kernel
CVE-2025-39964
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Medium Known exploited Also affects Kernel
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Critical Known exploited Also affects Kernel
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
High Known exploited Also affects Kernel
CVE-2024-53197
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
High Known exploited Also affects Kernel
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor