Vulnerability record · CVE-2024-53150 · published 24 December 2024
CVE-2024-53150: Linux kernel ALSA USB-audio out-of-bounds read in clock descriptor parsing
Debian · Debian Linux
The Linux kernel ALSA USB-audio driver fails to validate the bLength field of clock descriptors while traversing them, so a device supplying a malformed short descriptor can trigger out-of-bounds reads. The flaw is fixed by adding sanity checks that skip descriptors shorter than expected, including the UAC2/UAC3 clock selector's variable-length pin array. It matters because the vulnerable code path is reachable from USB device enumeration and has been added to CISA KEV.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Automated analysis
high priorityCVSS rates it 7.1 high and CISA KEV lists it as exploited, but exploitation requires local access and a crafted USB device, limiting broad remote abuse.
What it is
The Linux kernel ALSA USB-audio driver fails to validate the bLength field of clock descriptors while traversing them, so a device supplying a malformed short descriptor can trigger out-of-bounds reads. The flaw is fixed by adding sanity checks that skip descriptors shorter than expected, including the UAC2/UAC3 clock selector's variable-length pin array. It matters because the vulnerable code path is reachable from USB device enumeration and has been added to CISA KEV.
Impact
An attacker gains out-of-bounds kernel memory reads, which can leak memory contents and crash or destabilize the kernel (high confidentiality and availability impact per CVSS). There is no integrity impact and no code execution is described.
Attack surface
Reached locally via a malicious or malformed USB audio device attached to the system; the CVSS vector is AV:L/PR:L/UI:N, so low privileges are required and no user interaction is needed. The device must present crafted clock descriptors during USB-audio driver probing.
Exploitation
CVE-2024-53150 was added to CISA KEV on 2025-04-09 with a remediation due date of 2025-04-30, indicating known exploitation; EPSS 30-day probability is low at roughly 1.35 percent (70th percentile). No ransomware campaign use is documented.
What to do
- Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits, or update to a kernel release containing the fix.
- For Debian, apply the fixes announced in the debian-lts-announce March 2025 advisories.
- Restrict physical and logical USB device access to trusted hardware and personnel, since exploitation requires attaching a crafted device.
- Follow CISA BOD 22-01 guidance for cloud services and vendor instructions per the KEV required action.
- If patching is not possible, discontinue use of affected kernels in environments where untrusted USB devices can be connected.
Detection
- Monitor kernel logs for USB-audio descriptor parsing errors, warnings, or oopses tied to snd-usb-audio.
- Track USB device attach events and correlate unexpected or unknown audio-class devices with kernel crash or memory error telemetry.
- Use kernel crash dump or KASAN-enabled builds to catch out-of-bounds reads in the USB-audio clock descriptor traversal path.
- Audit systems for kernel versions prior to the stable patch commits and verify remediation status against the KEV due date.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-53150 to the Known Exploited Vulnerabilities catalog on 9 April 2025 as "Linux Kernel Out-of-Bounds Read Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 30 April 2025.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-53150 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-53150), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
