CVE-2024-53197

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

HIGH

7.8

CVSS Score

Published: December 27, 2024 at 01:49 PM UTC

Updated: June 17, 2026 at 08:08 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploitation

CISA KEV

Exploit prediction

EPSS 4%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score4.1%

EPSS (Exploit Prediction Scoring System) estimates a 4.1% chance this CVE is exploited in the wild within the next 30 days — higher than 91% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Apr 9, 2025

Remediation Due

Apr 30, 2025

544 days overdue

Notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/

https://source.android.com/docs/security/bulletin/2025-04-01

https://nvd.nist.gov/vuln/detail/CVE-2024-53197

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

2.6.12 ≤ v < 4.19.3252.6.12 ≤ v < 5.10.2312.6.12 ≤ v < 5.15.1742.6.12 ≤ v < 5.4.2872.6.12 ≤ v < 6.1.1202.6.12 ≤ v < 6.11.112.6.12 ≤ v < 6.12.22.6.12 ≤ v < 6.132.6.12 ≤ v < 6.6.644.20 ≤ v < 5.4.2875.11 ≤ v < 5.15.1745.16 ≤ v < 6.1.1205.5 ≤ v < 5.10.2316.12 ≤ v < 6.12.26.2 ≤ v < 6.6.646.7 ≤ v < 6.11.111da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12

Vendor states this is fixed in 0b4ea4bfe16566b84645ded1403756a2dc4e0f19 (fixed)

Vendor states this is fixed in 379d3b9799d9da953391e973b934764f01e03960 (fixed)

Vendor states this is fixed in 62dc01c83fa71e10446ee4c31e0e3d5d1291e865 (fixed)

Vendor states this is fixed in 920a369a9f014f10ec282fd298d0666129379f1b (fixed)

Vendor states this is fixed in 9887d859cd60727432a01564e8f91302d361b72b (fixed)

Vendor states this is fixed in 9b8460a2a7ce478e0b625af7c56d444dc24190f7 (fixed)

Vendor states this is fixed in b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca (fixed)

Vendor states this is fixed in b8f8b81dabe52b413fe9e062e8a852c48dd0680d (fixed)

Vendor states this is fixed in b909df18ce2a998afef81d58bbd1a05dc0788c40 (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 4.19.325 (unaffected)

Vendor states this is fixed in 5.10.231 (unaffected)

Vendor states this is fixed in 5.15.174 (unaffected)

Vendor states this is fixed in 5.4.287 (unaffected)

Vendor states this is fixed in 6.1.120 (unaffected)

Vendor states this is fixed in 6.11.11 (unaffected)

Vendor states this is fixed in 6.12.2 (unaffected)

Vendor states this is fixed in 6.13 (unaffected)

Vendor states this is fixed in 6.6.64 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references