#VU101910 Out-of-bounds read in Linux kernel - CVE-2024-53150

Vulnerability identifier: #VU101910

Vulnerability risk: High

CVSSv4.0: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2024-53150

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f
https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b
https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77
https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6
https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd
https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9
https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9
https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.