{"identifier":"CVE-2024-53197","cve":{"id":"CVE-2024-53197","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.","published":"2024-12-27T14:15:27.383000+00:00","modified":"2026-06-17T08:08:33.967000+00:00","status":"Analyzed","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"4.19.325"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"5.4.287"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"5.10.231"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"5.15.174"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"6.1.120"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"6.6.64"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"6.11.11"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"6.12.2"},{"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""}],"weaknesses":["CWE-787"],"references":[{"url":"https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2024-53197","vendorProject":"Linux","product":"Kernel","vulnerabilityName":"Linux Kernel Out-of-Bounds Access Vulnerability","dateAdded":"2025-04-09","shortDescription":"Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-30","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/ ; https://source.android.com/docs/security/bulletin/2025-04-01 ; https://nvd.nist.gov/vuln/detail/CVE-2024-53197","cwes":["CWE-787"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-09T18:17:11.337680Z","id":"CVE-2024-53197","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"4.19.325","matchCriteriaId":"FAEB49A0-3B16-46DF-AA21-AD4136295A41"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.287","matchCriteriaId":"E4B15788-D35E-4E5B-A9C0-070AE3729B34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.231","matchCriteriaId":"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.174","matchCriteriaId":"419FD073-1517-4FD5-8158-F94BC68A1E89"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.120","matchCriteriaId":"09AC6122-E2A4-40FE-9D33-268A1B2EC265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.64","matchCriteriaId":"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.11.11","matchCriteriaId":"21434379-192D-472F-9B54-D45E3650E893"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.2","matchCriteriaId":"D8882B1B-2ABC-4838-AC1D-DBDBB5764776"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:17:27.574342+00:00","exploited":true,"kev_stale":false,"products":["linux / linux kernel","debian / debian linux"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.04117,"percentile":0.9073,"date":"2026-10-27","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"git.kernel.org","source_url":"https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19","investigate_url":"https://investigate.aeglixmind.com/#git.kernel.org"},{"domain":"lists.debian.org","source_url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","investigate_url":"https://investigate.aeglixmind.com/#lists.debian.org"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2024-53197","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2024-53197","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2024-53197","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}