CVE-2024-53150
Linux Kernel Out-of-Bounds Read Vulnerability
Description
CVE-2024-53150 is a high-severity out-of-bounds read vulnerability in the Linux kernel's USB audio driver. The flaw exists in the clock source discovery code path within the ALSA USB-audio subsystem, where descriptor traversal fails to validate the bLength field of each descriptor. A local attacker with low privileges can trigger this vulnerability by connecting a specially crafted USB device with bogus descriptors, potentially reading sensitive kernel memory or causing a system crash. With a CVSS v3.1 score of 7.1 and its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 30, 2025, this Linux kernel vulnerability demands prompt patching, particularly on systems that accept untrusted USB devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 11.0 |
| linux | linux kernel | < 5.4.287; >= 5.5, < 5.10.231; >= 5.11, < 5.15.174; >= 5.16, < 6.1.120; >= 6.2, < 6.6.64; >= 6.7, < 6.11.11; >= 6.12, < 6.12.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
- https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f(Patch)
- https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b(Patch)
- https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77(Patch)
- https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6(Patch)
- https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd(Patch)
- https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9(Patch)
- https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9(Patch)
- https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d(Patch)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53150(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
CVE-2024-53150 is classified under CWE-125 (Out-of-bounds Read), a weakness where software reads data past the end or before the beginning of an intended buffer. In the Linux kernel's ALSA USB-audio driver, the clock descriptor traversal code does not verify the bLength field of USB descriptors before accessing their contents. When a malicious USB device provides a descriptor with an artificially short bLength value, the kernel reads memory beyond the descriptor boundary, potentially leaking sensitive information or triggering a kernel panic.
Learn more: CWE-125 — Out-of-bounds Read
Impact Analysis
CVE-2024-53150 carries a CVSS v3.1 base score of 7.1 (High), reflecting significant risk to both confidentiality and availability. The vulnerability requires local access (AV:L) through a USB interface, meaning an attacker needs physical proximity or the ability to connect a malicious USB device to the target system. Exploitation complexity is low (AC:L), requiring no special conditions beyond plugging in the crafted device. The attacker needs only low-level user privileges (PR:L) and no user interaction (UI:N) is required. Confidentiality impact is rated High because the out-of-bounds read can expose sensitive kernel memory contents, including credentials, cryptographic keys, or kernel address space layout information useful for further attacks. Availability impact is also High as the out-of-bounds access can trigger a kernel panic, crashing the entire system. Integrity remains unaffected since this is a read-only vulnerability. With an EPSS score of 1.0% at the 77th percentile, active exploitation is possible, and organizations running affected Linux kernel versions on systems with USB access should prioritize remediation.
Exploit Maturity
CVE-2024-53150 has been confirmed as actively exploited, evidenced by its addition to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 30, 2025. The EPSS score of 1.0% at the 77th percentile indicates possible but not yet widespread exploitation. Multiple kernel patches have been committed to the stable branches, with patch commits available in the public git repositories. While the attack vector requires local USB access, the vulnerability is particularly concerning for environments where USB devices from untrusted sources may be connected, such as kiosks, shared workstations, or systems in physically accessible locations.
Remediation
-
Apply kernel patches immediately. Update the Linux kernel to a fixed version: 5.4.287+, 5.10.231+, 5.15.174+, 6.1.120+, 6.6.64+, 6.11.11+, or 6.12.2+ depending on your kernel branch. Debian 11 users should apply the latest kernel security update from the Debian LTS repository.
-
Disable or restrict USB device access on systems where untrusted USB devices may be connected. Use usbguard or kernel USB authorization mechanisms to whitelist only known devices, preventing malicious USB descriptors from being processed by the vulnerable driver.
-
Unload the snd-usb-audio kernel module on systems that do not require USB audio functionality. Running
modprobe -r snd-usb-audioand blacklisting the module in/etc/modprobe.d/eliminates the attack surface entirely for systems that do not need USB audio support. -
Monitor kernel logs for signs of exploitation. Review
dmesgoutput and system logs for USB-related kernel warnings, unexpected crashes, or NULL pointer dereference messages associated with the snd-usb-audio driver. Implement crash dump analysis (kdump) to capture and investigate any kernel panics. -
Implement physical security controls to prevent unauthorized USB device connections on sensitive systems. USB port locks, endpoint protection agents with USB device control, and security policies restricting USB usage reduce the risk of local exploitation.
Technical Details
CVE-2024-53150 resides in the ALSA USB-audio subsystem of the Linux kernel, specifically in the clock source discovery functions that traverse USB audio class descriptors. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H confirms this is a locally exploitable vulnerability requiring low privileges. When the kernel enumerates USB audio devices, it processes clock source, clock selector, and clock multiplier descriptors by iterating through descriptor chains. The vulnerable code path reads descriptor fields based on the expected structure size without first validating that the actual bLength field matches or exceeds the minimum required length. A malicious USB device can supply descriptors with intentionally truncated bLength values, causing the kernel to read memory beyond the descriptor buffer boundary. For UAC2 and UAC3 clock selector descriptors, additional array elements (bNrInPins) and trailing fields compound the issue, as the code accesses variable-length arrays without bounds verification. The fix adds sanity checks to the validator functions, comparing bLength against sizeof() for each descriptor type and skipping descriptors with insufficient length.
Frequently Asked Questions
Is CVE-2024-53150 being actively exploited?
Yes. CISA has added CVE-2024-53150 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 1.0% places it at the 77th percentile, indicating exploitation activity above most vulnerabilities.
What products are affected by CVE-2024-53150?
The vulnerability affects the Linux kernel versions prior to 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, and 6.12.2 across their respective branches. Debian Linux 11 is also confirmed affected. Any Linux system using the snd-usb-audio kernel module with USB audio device support is potentially vulnerable.
How do I fix CVE-2024-53150?
Update your Linux kernel to a patched version for your branch. If immediate patching is not possible, disable or unload the snd-usb-audio kernel module and restrict USB device access on affected systems.
How severe is CVE-2024-53150?
CVE-2024-53150 has a CVSS v3.1 score of 7.1 (High severity). While it requires local access via USB, successful exploitation can leak sensitive kernel memory and crash the system. Its KEV catalog inclusion underscores the real-world threat.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.