CVE-2024-53150

Estado: AnalizadaAlta (7.1)⚠ Explotación activa

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type.

Leer descripción completaMostrar menos

OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.35%
Percentil entre todas las CVEs puntuadas: 71
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 9/4/2025
Plazo de remediación: 30/4/2025
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %

Vulnerabilidad local (AV:L, PR:L) en driver USB-audio del kernel Linux permite lectura fuera de límites (CWE-125) que puede explotarse para escalada de privilegios. El impacto de disponibilidad alto y la naturaleza de out-of-bounds sugieren DoS o ejecución de código.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (2)

Debian — Debian Linux Linux — Linux Kernel

CWE

CWE-125
CWE-125

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-53150",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53150",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-09T18:17:06.181809Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "a632bdcb359fd8145e86486ff8612da98e239acd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "da13ade87a12dd58829278bc816a61bea06a56a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "74cb86e1006c5437b1d90084d22018da30fddc77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "ea0fa76f61cf8e932d1d26e6193513230816e11d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "096bb5b43edf755bc4477e64004fa3a20539ec2f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a",
              "lessThan": "a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9feeaa50e5b4b0b71259d918a36ecf9059e60796",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3b17a13b687ae99939dc94a4ae01fbc34f68decc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.19.84",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.3.11",
              "lessThan": "5.4",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "sound/usb/clock.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver",
              "lessThanOrEqual": "6.11.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/usb/clock.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-12-24T12:15:23.117",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53150",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors.  That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal.  When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ALSA: usb-audio: corrige lecturas fuera de los límites al encontrar fuentes de reloj. El código actual del controlador de audio USB no verifica la bLongitud de cada descriptor al atravesar los descriptores de reloj. Es decir, cuando un dispositivo proporciona un descriptor falso con una longitud b más corta, el controlador podría alcanzar lecturas fuera de los límites. Para solucionarlo, este parche agrega controles de cordura a las funciones de validación para el recorrido del descriptor de reloj. Cuando la longitud del descriptor es más corta de lo esperado, se omite en el bucle. Para los descriptores de fuente de reloj y multiplicador de reloj, podemos comparar bLength con el sizeof() de cada tipo de descriptor. OTOH, el descriptor del selector de reloj de UAC2 y UAC3 tiene una matriz de elementos bNrInPins y dos campos más en su cola, por lo que deben verificarse además de la verificación sizeof()."
    }
  ],
  "lastModified": "2026-06-17T08:08:25.567",
  "cisaActionDue": "2025-04-30",
  "cisaExploitAdd": "2025-04-09",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC7D5C80-B677-4131-A399-3366D7F3961C",
              "versionEndExcluding": "5.4.287"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935",
              "versionEndExcluding": "5.10.231",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89",
              "versionEndExcluding": "5.15.174",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265",
              "versionEndExcluding": "6.1.120",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7",
              "versionEndExcluding": "6.6.64",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893",
              "versionEndExcluding": "6.11.11",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
              "versionEndExcluding": "6.12.2",
              "versionStartIncluding": "6.12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Linux Kernel Out-of-Bounds Read Vulnerability"
}