CyberSecBulletin
CVE-2024-53150Exploited in the wildNVD status: Analyzed

Linux Kernel Out-of-Bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2024-53150 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions a632bdcb359fd8145e86486ff8612da98e239acd, 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b, ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on April 9, 2025, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Linux to a632bdcb359fd8145e86486ff8612da98e239acd or 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b or ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9 or da13ade87a12dd58829278bc816a61bea06a56a9, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.287 or 5.10.231 or 5.15.174 or 6.1.120, whichever matches your release line, or a later version.
  3. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, a632bdcb359fd8145e86486ff8612da98e239acd; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, da13ade87a12dd58829278bc816a61bea06a56a9; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, 74cb86e1006c5437b1d90084d22018da30fddc77; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, ea0fa76f61cf8e932d1d26e6193513230816e11d; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, 096bb5b43edf755bc4477e64004fa3a20539ec2f; b8e4f1fdfa422398c2d6c47bfb7d1feb3046d70a up to, but not including, a3dd4d63eeb452cfb064a13862fb376ab108f6a6; and 5 more rangesa632bdcb359fd8145e86486ff8612da98e239acd, 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b, ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9, da13ade87a12dd58829278bc816a61bea06a56a9, 74cb86e1006c5437b1d90084d22018da30fddc77, ea0fa76f61cf8e932d1d26e6193513230816e11d
DebianDebian Linux11.0Not stated
LinuxLinux Kernelbefore 5.4.287; 5.5 up to, but not including, 5.10.231; 5.11 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.120; 6.2 up to, but not including, 6.6.64; 6.7 up to, but not including, 6.11.11; 6.12 up to, but not including, 6.12.25.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.1HighNVD
CVSS 3.17.1HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
  3. Added to CISA's Known Exploited Vulnerabilities catalogue.
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.