In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-0149dd23" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-041a5b90" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-05b77ef3" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-0a7e046f" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_multiplier_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-13c3101d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-15986ec2" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "208077417731610040877131155106667370916" ] }, "id": "CVE-2024-53150-1f78fae5" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-25a7b69e" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "235371844192433601046661857425643057091" ] }, "id": "CVE-2024-53150-27a9dc4c" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_multiplier_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-31e305f1" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-35d8ccf2" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_selector_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-366c673c" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_source_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-3ecbccbb" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_multiplier_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-41fc63ce" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "208077417731610040877131155106667370916" ] }, "id": "CVE-2024-53150-4475f512" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-5268cd15" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-53ca1944" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "190480137554049881641567851632324081835", "313415775226754002500885520918833196126", "82555201188140996456345296926623856212", "87435116755367617375918493576975623558", "118029532504438032422045973220956747692", "86289801404198549091542961132369570464", "220212868392417481064746174393042142439", "199318449085753530376514050807238454761", "194673796748205750424516353599066960939", "144429485527983622871991503440612883501", "291675083061342851481456774900248065270", "172978336157114635112484480394227278400", "303917011797944180594415274832633230447", "126138468656954242886753749547359874201", "89032028464034493061657757133211208325", "186544046522081535772787729365053322761", "8793685140927732733902216523596285686", "150775159933887599449726288434523505860", "169342986921341837506587537831921327571", "277383772808093874689371046146183962256", "321751572182996240209526231514296708801", "33489211343182178521491564704842279364", "38707233593408539040273076399216912513", "93450490234408485619556144689389884509", "36914966696773167751852069416266128479", "265164503884099600389557505075520355928", "44311822666168872213841145644672592549", "256343590266088326204583913215287909787", "241722597037658338698648413902411690541", "254080984309912690622195166464590815317", "178094627140996493994943936173774722374", "36373320951121792030163997108680306648" ] }, "id": "CVE-2024-53150-54b01ab6" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_selector_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-5c338edc" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-6dfc8523" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "235371844192433601046661857425643057091" ] }, "id": "CVE-2024-53150-7851f058" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "235371844192433601046661857425643057091" ] }, "id": "CVE-2024-53150-785d6975" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-80a362e7" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-86d31eca" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "190480137554049881641567851632324081835", "313415775226754002500885520918833196126", "82555201188140996456345296926623856212", "87435116755367617375918493576975623558", "118029532504438032422045973220956747692", "86289801404198549091542961132369570464", "220212868392417481064746174393042142439", "199318449085753530376514050807238454761", "194673796748205750424516353599066960939", "144429485527983622871991503440612883501", "291675083061342851481456774900248065270", "172978336157114635112484480394227278400", "303917011797944180594415274832633230447", "126138468656954242886753749547359874201", "89032028464034493061657757133211208325", "186544046522081535772787729365053322761", "8793685140927732733902216523596285686", "150775159933887599449726288434523505860", "169342986921341837506587537831921327571", "277383772808093874689371046146183962256", "321751572182996240209526231514296708801", "33489211343182178521491564704842279364", "38707233593408539040273076399216912513", "93450490234408485619556144689389884509", "36914966696773167751852069416266128479", "265164503884099600389557505075520355928", "44311822666168872213841145644672592549", "256343590266088326204583913215287909787", "241722597037658338698648413902411690541", "254080984309912690622195166464590815317", "178094627140996493994943936173774722374", "36373320951121792030163997108680306648" ] }, "id": "CVE-2024-53150-88178a2d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_selector_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-9042169e" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea0fa76f61cf8e932d1d26e6193513230816e11d", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-9ba81d0d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da13ade87a12dd58829278bc816a61bea06a56a9", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-a2252d2e" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "signature_version": "v1", "target": { "file": "sound/usb/clock.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "265400977830982444295918294344149627393", "171085873840617657274733885613391206196", "82997789143412418524293536495802543461", "125812141739208913212144361011428449281", "53534113893816824882743326171284255687", "31223010587888343773372201349606036635", "109183856859433338318935067452231071640", "93240069133706551160883144084831253247", "24637483293542169037362240142467062455", "42310106538543845895214824549317468123", "70372097107003232583350646205985042588", "44848510674293726028304985816668968447", "331833405989284484880620199056643806100", "235371844192433601046661857425643057091" ] }, "id": "CVE-2024-53150-ad74920b" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_selector_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-b73f2361" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_source_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-bd02dbf7" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dd4d63eeb452cfb064a13862fb376ab108f6a6", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-c68755dc" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a92cbc88e4013bfed7fd2ccab3ade45f8e896b", "signature_version": "v1", "target": { "function": "validate_clock_source_v3", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-cc6f4926" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9", "signature_version": "v1", "target": { "function": "validate_clock_multiplier", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-d6003989" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_multiplier_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-e8394dbb" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a632bdcb359fd8145e86486ff8612da98e239acd", "signature_version": "v1", "target": { "function": "validate_clock_source_v2", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "171465631303192223857394454640013003320", "length": 113.0 }, "id": "CVE-2024-53150-f3274fa2" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@096bb5b43edf755bc4477e64004fa3a20539ec2f", "signature_version": "v1", "target": { "function": "validate_clock_selector", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-f6e19991" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cb86e1006c5437b1d90084d22018da30fddc77", "signature_version": "v1", "target": { "function": "validate_clock_source", "file": "sound/usb/clock.c" }, "digest": { "function_hash": "205785718781910012398978548638517445518", "length": 147.0 }, "id": "CVE-2024-53150-ff071050" } ]