CVE-2024-53197: high-severity vulnerability in Linux
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A malicious USB audio device (like Extigy or Mbox) can trick the Linux kernel into accessing memory outside its allocated bounds by reporting an incorrect number of configurations. This could crash the system or allow an attacker to read sensitive data.
The vulnerability occurs when a crafted USB device provides a bNumConfigurations value larger than the number of configuration structures allocated during usb_get_configuration. This leads to out-of-bounds memory access in subsequent operations like usb_destroy_configuration. The attack vector is direct USB device connection with no special privileges required.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.