In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9",
"signature_type": "Function",
"id": "CVE-2024-53150-0149dd23",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f",
"signature_type": "Function",
"id": "CVE-2024-53150-041a5b90",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d",
"signature_type": "Function",
"id": "CVE-2024-53150-05b77ef3",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77",
"signature_type": "Function",
"id": "CVE-2024-53150-0a7e046f",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-13c3101d",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
"signature_type": "Function",
"id": "CVE-2024-53150-15986ec2",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f",
"signature_type": "Line",
"id": "CVE-2024-53150-1f78fae5",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"208077417731610040877131155106667370916"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f",
"signature_type": "Function",
"id": "CVE-2024-53150-25a7b69e",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d",
"signature_type": "Line",
"id": "CVE-2024-53150-27a9dc4c",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-31e305f1",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
"signature_type": "Function",
"id": "CVE-2024-53150-35d8ccf2",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-366c673c",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-3ecbccbb",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-41fc63ce",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
"signature_type": "Line",
"id": "CVE-2024-53150-4475f512",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"208077417731610040877131155106667370916"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77",
"signature_type": "Function",
"id": "CVE-2024-53150-5268cd15",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9",
"signature_type": "Function",
"id": "CVE-2024-53150-53ca1944",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Line",
"id": "CVE-2024-53150-54b01ab6",
"digest": {
"line_hashes": [
"190480137554049881641567851632324081835",
"313415775226754002500885520918833196126",
"82555201188140996456345296926623856212",
"87435116755367617375918493576975623558",
"118029532504438032422045973220956747692",
"86289801404198549091542961132369570464",
"220212868392417481064746174393042142439",
"199318449085753530376514050807238454761",
"194673796748205750424516353599066960939",
"144429485527983622871991503440612883501",
"291675083061342851481456774900248065270",
"172978336157114635112484480394227278400",
"303917011797944180594415274832633230447",
"126138468656954242886753749547359874201",
"89032028464034493061657757133211208325",
"186544046522081535772787729365053322761",
"8793685140927732733902216523596285686",
"150775159933887599449726288434523505860",
"169342986921341837506587537831921327571",
"277383772808093874689371046146183962256",
"321751572182996240209526231514296708801",
"33489211343182178521491564704842279364",
"38707233593408539040273076399216912513",
"93450490234408485619556144689389884509",
"36914966696773167751852069416266128479",
"265164503884099600389557505075520355928",
"44311822666168872213841145644672592549",
"256343590266088326204583913215287909787",
"241722597037658338698648413902411690541",
"254080984309912690622195166464590815317",
"178094627140996493994943936173774722374",
"36373320951121792030163997108680306648"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-5c338edc",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d",
"signature_type": "Function",
"id": "CVE-2024-53150-6dfc8523",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9",
"signature_type": "Line",
"id": "CVE-2024-53150-7851f058",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77",
"signature_type": "Line",
"id": "CVE-2024-53150-785d6975",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
"signature_type": "Function",
"id": "CVE-2024-53150-80a362e7",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
"signature_type": "Function",
"id": "CVE-2024-53150-86d31eca",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Line",
"id": "CVE-2024-53150-88178a2d",
"digest": {
"line_hashes": [
"190480137554049881641567851632324081835",
"313415775226754002500885520918833196126",
"82555201188140996456345296926623856212",
"87435116755367617375918493576975623558",
"118029532504438032422045973220956747692",
"86289801404198549091542961132369570464",
"220212868392417481064746174393042142439",
"199318449085753530376514050807238454761",
"194673796748205750424516353599066960939",
"144429485527983622871991503440612883501",
"291675083061342851481456774900248065270",
"172978336157114635112484480394227278400",
"303917011797944180594415274832633230447",
"126138468656954242886753749547359874201",
"89032028464034493061657757133211208325",
"186544046522081535772787729365053322761",
"8793685140927732733902216523596285686",
"150775159933887599449726288434523505860",
"169342986921341837506587537831921327571",
"277383772808093874689371046146183962256",
"321751572182996240209526231514296708801",
"33489211343182178521491564704842279364",
"38707233593408539040273076399216912513",
"93450490234408485619556144689389884509",
"36914966696773167751852069416266128479",
"265164503884099600389557505075520355928",
"44311822666168872213841145644672592549",
"256343590266088326204583913215287909787",
"241722597037658338698648413902411690541",
"254080984309912690622195166464590815317",
"178094627140996493994943936173774722374",
"36373320951121792030163997108680306648"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-9042169e",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d",
"signature_type": "Function",
"id": "CVE-2024-53150-9ba81d0d",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9",
"signature_type": "Function",
"id": "CVE-2024-53150-a2252d2e",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
"signature_type": "Line",
"id": "CVE-2024-53150-ad74920b",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/clock.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-b73f2361",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-bd02dbf7",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6",
"signature_type": "Function",
"id": "CVE-2024-53150-c68755dc",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b",
"signature_type": "Function",
"id": "CVE-2024-53150-cc6f4926",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source_v3"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9",
"signature_type": "Function",
"id": "CVE-2024-53150-d6003989",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-e8394dbb",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_multiplier_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd",
"signature_type": "Function",
"id": "CVE-2024-53150-f3274fa2",
"digest": {
"length": 113.0,
"function_hash": "171465631303192223857394454640013003320"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source_v2"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f",
"signature_type": "Function",
"id": "CVE-2024-53150-f6e19991",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_selector"
},
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77",
"signature_type": "Function",
"id": "CVE-2024-53150-ff071050",
"digest": {
"length": 147.0,
"function_hash": "205785718781910012398978548638517445518"
},
"target": {
"file": "sound/usb/clock.c",
"function": "validate_clock_source"
},
"signature_version": "v1"
}
]