CVE-2024-53150 Overview
CVE-2024-53150 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's ALSA USB-audio driver. The flaw resides in the clock descriptor traversal logic, which fails to validate the bLength field of each USB descriptor. A malicious or malformed USB device can supply a descriptor with a shorter-than-expected bLength, causing the driver to read beyond the allocated buffer.
The vulnerability affects the Linux kernel and Debian Linux distributions. CISA has added CVE-2024-53150 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
Critical Impact
Local attackers with the ability to attach a crafted USB-audio device can trigger kernel memory disclosure or denial of service through out-of-bounds reads in the ALSA clock source parser.
Affected Products
- Linux Kernel (multiple versions prior to patched commits)
- Debian Linux 11.0
- Debian LTS supported releases
Discovery Timeline
- 2024-12-24 - CVE-2024-53150 published to NVD
- 2025-03 - Debian LTS security announcements released
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2024-53150
Vulnerability Analysis
The vulnerability lives in the Linux kernel's sound/usb/ ALSA USB-audio driver. When the driver enumerates USB Audio Class (UAC) clock descriptors, it iterates over a descriptor list provided by the connected USB device. The traversal logic dereferences each descriptor without first verifying that the reported bLength is large enough to contain the structure being parsed.
Clock source and clock multiplier descriptors have fixed sizes, while the UAC2 and UAC3 clock selector descriptor contains a variable bNrInPins array followed by two additional trailing fields. The original code trusted device-supplied length fields, allowing parsing routines to walk past the descriptor buffer boundary.
The upstream fix adds sanity checks to the validator functions used during clock descriptor traversal. Descriptors with a bLength shorter than sizeof() of their structure are skipped. For UAC2 and UAC3 clock selectors, the patch additionally validates the size required by bNrInPins plus the trailing fields.
Root Cause
The root cause is missing input validation [CWE-125] on attacker-controlled USB descriptor lengths. The driver assumed descriptor structures matched the USB Audio Class specification without enforcing minimum length requirements before field access.
Attack Vector
Exploitation requires local physical or virtual access to attach a USB device. An attacker presents a crafted USB-audio device that advertises malformed clock descriptors with a truncated bLength. When the kernel enumerates the device, the parsing loop reads adjacent kernel memory, which can leak sensitive data or destabilize the system. Programmable USB devices such as Facedancer, Raspberry Pi Zero, and BadUSB-class hardware make this attack practical against unattended endpoints.
No verified public proof-of-concept code is available. See the kernel commit history for technical patch details.
Detection Methods for CVE-2024-53150
Indicators of Compromise
- Unexpected USB-audio device enumeration events in dmesg or journalctl with malformed descriptor warnings.
- Kernel oops, panic, or KASAN reports referencing functions such as parse_audio_unit, snd_usb_find_clock_source, or snd_usb_find_clock_selector.
- Repeated USB device connect/disconnect cycles originating from unauthorized hardware.
Detection Strategies
- Monitor kernel logs for ALSA USB-audio parser errors and out-of-bounds access indicators reported by KASAN-instrumented kernels.
- Audit USB device connection events through udev and correlate with user sessions to identify unauthorized peripherals.
- Inspect endpoint telemetry for new USB vendor and product IDs not previously seen on managed Linux hosts.
Monitoring Recommendations
- Forward auditd and kern.log data to a centralized SIEM and alert on ALSA subsystem warnings.
- Enable USB device allow-listing through tools such as USBGuard and log policy violations.
- Track kernel package versions across the fleet to identify unpatched hosts running vulnerable linux-image releases.
How to Mitigate CVE-2024-53150
Immediate Actions Required
- Apply the latest kernel updates from your Linux distribution; Debian users should install fixes from the Debian LTS announcement.
- Inventory all Linux hosts running affected kernel versions and prioritize patching for systems with exposed USB ports.
- Review CISA KEV catalog status and align remediation with CISA Known Exploited Vulnerabilities deadlines.
Patch Information
The Linux kernel maintainers released fixes across stable branches. Relevant commits include ea0fa76f61cf8e932d1d26e6193513230816e11d, a632bdcb359fd8145e86486ff8612da98e239acd, 74cb86e1006c5437b1d90084d22018da30fddc77, and ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9. Debian LTS shipped corresponding package updates through its March 2025 advisories. Reference the kernel.org stable tree for full commit metadata.
Workarounds
- Disable the snd_usb_audio kernel module on systems that do not require USB audio functionality using modprobe -r snd_usb_audio and a blacklist entry.
- Deploy USBGuard or equivalent device control to block untrusted USB peripherals from being enumerated by the kernel.
- Physically restrict USB port access on servers and kiosks, or use port-blocking hardware where software controls are insufficient.
# Configuration example
# Blacklist the vulnerable ALSA USB-audio module until patched
echo "blacklist snd_usb_audio" | sudo tee /etc/modprobe.d/blacklist-snd-usb-audio.conf
sudo update-initramfs -u
# Verify installed kernel version against Debian advisory
dpkg -l | grep linux-image
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
