CVE-2024-53150

What it actually does

The flaw is an out-of-bounds read in the Linux kernel ALSA USB-audio driver during traversal of USB Audio Class clock descriptors. A malformed USB audio device can advertise descriptor lengths that are shorter than the driver expects; vulnerable kernels may then read beyond the valid descriptor buffer while parsing clock source, clock selector, or clock multiplier structures. The primary impact is kernel memory disclosure and potential kernel instability or crash during device enumeration. Exploitation requires the target to process a malicious or compromised USB audio device, including physical USB attachment, USB-over-IP, device passthrough, docking stations, KVMs, or virtualized USB redirection paths.

Why it matters to the business

Successful exploitation can expose sensitive kernel memory and may disrupt endpoints, workstations, kiosks, jump boxes, audio-enabled servers, or virtual desktop infrastructure that accepts USB audio devices. Because this issue is listed in CISA KEV with active in-the-wild exploitation and a remediation due date of 2025-04-30, organizations should treat it as higher priority than its EPSS score alone suggests. The provided affected-product metadata lists Ubuntu php5/php7.0 packages and fixed versions, which appears inconsistent with the Linux kernel ALSA USB-audio vulnerability description; remediation tracking should be validated against the operating system/kernel vendor advisory for the actual deployed kernel packages.

How an attack unfolds

An attacker prepares a USB device, USB gadget, or emulated USB peripheral that identifies as a USB audio device and supplies malformed USB Audio Class descriptors. The key manipulation is setting descriptor bLength fields, especially for clock source, clock selector, or clock multiplier descriptors, shorter than the kernel driver expects while still causing the ALSA USB-audio parser to walk those descriptors. When the vulnerable host enumerates the device, the snd-usb-audio driver parses the bogus descriptor chain and can read beyond the descriptor boundary. Depending on memory layout and kernel hardening, the result may be a kernel information leak, a crash/oops, or evidence in kernel logs from sanitizer/hardening checks. Reported exploitation context indicates active in-the-wild use in broader zero-day campaigns by espionage and financially motivated actors, so incident review should include both physical/near-physical USB exposure and remote USB redirection channels.

How to fix it

Update affected Linux kernels to vendor releases that include the ALSA usb-audio descriptor length validation fix for clock descriptor traversal. Prioritize internet-managed endpoints, developer workstations, VDI hosts, kiosk systems, jump hosts, and systems that allow USB passthrough or USB redirection. If immediate patching is not possible, reduce exposure by disabling untrusted USB device attachment, blocking USB audio class devices where operationally feasible, disabling USB passthrough/redirection in virtualization and remote access platforms, and preventing automatic loading or use of the snd-usb-audio driver on systems that do not require USB audio. The supplied fixed_versions list references Ubuntu php5/php7.0 packages, not kernel packages; do not rely on those package versions as proof of remediation for this kernel driver issue without confirming the vendor advisory and installed kernel build contain the fix.

How to confirm the fix worked

Confirm the installed kernel package is at or above the vendor-fixed build that includes the ALSA usb-audio clock descriptor bLength sanity checks. Validate by checking vendor advisories, package changelogs, and kernel source or symbol provenance for the fix in the snd-usb-audio driver. On Linux systems, inventory loaded/available driver exposure with lsmod, modinfo snd_usb_audio, and kernel package version checks. Where USB device control is deployed, verify policy enforcement by attempting to attach or redirect a benign USB audio device and confirming whether it is allowed only on approved systems. Reboot into the fixed kernel after installation, because updating kernel packages without booting the corrected kernel does not remediate runtime exposure.

Typical attack path

1. Identify a target system that runs a vulnerable Linux kernel with the ALSA USB-audio driver enabled or available for autoloading.
2. Prepare or emulate a malicious USB audio device with malformed USB Audio Class clock descriptors and intentionally short bLength values.
3. Get the target to enumerate the device through direct USB insertion, a malicious peripheral, compromised docking hardware, USB/IP, virtual desktop USB redirection, hypervisor passthrough, or lab/support equipment.
4. Trigger snd-usb-audio parsing during USB enumeration or audio device initialization.
5. Cause the vulnerable driver to perform out-of-bounds reads while traversing clock source, selector, or multiplier descriptors.
6. Use the resulting memory exposure or kernel instability to support further exploitation, reconnaissance, or denial of service, depending on the exploit chain and kernel mitigations.

How to detect it

Look for evidence of suspicious USB audio device enumeration followed by kernel errors, crashes, sanitizer findings, or oops traces involving snd-usb-audio and clock descriptor parsing. Useful log sources include journalctl -k, /var/log/kern.log, /var/log/messages, auditd logs, EDR device-control telemetry, USB device-management platforms, VDI/remote-access USB redirection logs, hypervisor passthrough logs, and physical access/device insertion records. Search for newly attached USB audio devices with unusual vendor/product IDs, missing or malformed descriptor data, repeated disconnect/reconnect behavior, or kernel messages immediately before a panic or service interruption. For already-exploited systems, preserve kernel logs, crash dumps, vmcores, USB descriptor captures from /sys/bus/usb/devices/*/descriptors where available, and any EDR records showing USB device class 01 audio devices. Active campaign context means detections should not be limited to physical USB insertion; also review USB-over-IP, remote support, VDI, and virtualization channels that can present attacker-controlled USB devices to a Linux kernel.

• snd_usb_audio
• snd-usb-audio
• RIP: .*snd_usb_find_clock_source
• RIP: .*snd_usb_find_clock_selector
• RIP: .*snd_usb_find_clock_multiplier
• BUG: KASAN: slab-out-of-bounds.*snd_usb
• BUG: KASAN: out-of-bounds.*snd_usb_audio
• UBSAN: array-index-out-of-bounds.*snd_usb
• general protection fault.*snd_usb_audio
• kernel BUG.*snd_usb_audio
• Oops:.*snd_usb_audio
• usbcore: registered new interface driver snd-usb-audio
• New USB device found
• Product: USB Audio
• /sys/bus/usb/devices/*/descriptors
• /var/log/kern.log
• /var/log/messages

What your security team should do

• Treat this as a priority kernel remediation item because it is KEV-listed and marked active in the wild, even though the EPSS score is relatively low.
• Run an enterprise inventory for Linux systems with vulnerable kernel builds and exposure to USB audio devices, USB passthrough, USB/IP, VDI redirection, docking stations, or shared peripheral infrastructure.
• Patch kernels through the operating system vendor channel and confirm systems have rebooted into the fixed kernel.
• Temporarily block or restrict USB audio class devices on high-risk systems until patching is complete.
• Disable USB redirection and hypervisor passthrough for untrusted users or untrusted peripherals where not required.
• Review kernel, audit, EDR, and device-management logs for suspicious USB audio enumeration, kernel oopses, KASAN reports, or crashes involving snd-usb-audio.
• Investigate any unexplained kernel crash or panic shortly after USB audio device attachment as potentially security relevant.
• Validate the affected-product and fixed-version mapping against vendor kernel advisories because the supplied package list appears inconsistent with the described Linux kernel vulnerability.