CVE-2024-53150·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.12.2
- Published
- 2024-12-24
Affected versions
From: 6.12
Until: 6.12.2
Fixed in: 6.12.2
How to fix this CVE
Update the Linux kernel to a patched version. Blacklist the snd-usb-audio module on servers that do not use USB audio. Restrict physical USB access.
# Immediate mitigation without reboot:
sudo modprobe -r snd-usb-audio 2>/dev/null
echo 'blacklist snd-usb-audio' | sudo tee /etc/modprobe.d/blacklist-usb-audio.confDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
Physical access attack via malicious USB audio device. A crafted device provides USB audio descriptors with invalid bLength fields for clock source entries. When the kernel parses these descriptors to find clock sources, it reads beyond the descriptor buffer, leaking kernel heap memory. This leaked data can defeat KASLR and enable further exploitation.WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
WAF cannot mitigate USB-level kernel vulnerabilities. Compensating controls: blacklist snd-usb-audio, deploy USBGuard, disable unused USB ports in BIOS, restrict physical access, and maintain rapid kernel patching.How to check if you are affected
- Check kernel version against security advisories for your distribution
- Check if snd-usb-audio is loaded: lsmod | grep snd_usb_audio
- Monitor dmesg for USB audio parsing errors: dmesg | grep -i 'usb.*audio\|clock.*source'
- Verify USBGuard status: systemctl status usbguard 2>/dev/null
- Check USB authorization: find /sys/bus/usb/devices -name authorized -exec cat {} \;
Indicators of compromise
- USB audio devices with malformed clock source descriptors in kernel logs
- KASAN reports mentioning usb-audio clock source parsing functions
- Unexpected snd-usb-audio module loads on headless servers
- Kernel heap information leaks correlated with USB device insertion events
FAQ
How does this differ from CVE-2024-53197?
Both are in the USB audio driver, but this CVE is an out-of-bounds read (information leak) in clock source parsing, while CVE-2024-53197 is an out-of-bounds access in configuration parsing for specific devices. They have similar mitigations — blacklisting snd-usb-audio addresses both.
Can information leaks alone compromise a server?
Not directly, but information leaks that reveal kernel memory layout (defeating KASLR) are critical building blocks for kernel exploitation chains. This is why CISA KEV lists it despite being 'only' an information disclosure.
Does blacklisting snd-usb-audio fix both CVE-2024-53150 and CVE-2024-53197?
Yes. Both vulnerabilities are in the snd-usb-audio module. Blacklisting it prevents the vulnerable code from loading, mitigating both CVEs simultaneously.
Are containers or VMs affected?
Only if USB device passthrough is configured. Standard containers and VMs without USB access are not affected.
Is this being exploited in the wild?
Yes. Its inclusion in CISA KEV indicates active exploitation, likely as part of targeted attack chains that combine information disclosure with privilege escalation vulnerabilities.
Related Kernel CVEs
References
- https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f
- https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b
- https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77
- https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6
- https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-53150. Free for 1 server.
Get started free