Loading vulnerability…
Out-of-bounds access in Linux kernel ALSA USB-audio Extigy and Mbox handling
CVE-2024-53197 is an out-of-bounds memory-access vulnerability in the Linux kernel ALSA USB-audio handling for Extigy and Mbox devices. A malicious USB device can supply a bNumConfigurations value greater than the initial value used by usb_get_configuration() to allocate the dev->config array. This inconsistency can cause subsequent kernel operations, including usb_destroy_configuration(), to access memory beyond the allocated array.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-controlled USB configuration information can trigger out-of-bounds accesses in kernel context, potentially causing a kernel crash and system-wide denial of service. The precise access primitive and whether this flaw independently permits information disclosure or arbitrary code execution are not established. Active exploitation of CVE-2024-53197 has been confirmed for Android.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted USB devices from being connected or authorized, particularly devices presenting as Extigy or Mbox audio hardware. Where USB audio is unnecessary, disabling the affected ALSA USB-audio driver can reduce exposure. These measures do not replace the kernel update.
Patch, then assume compromise.
Install the vendor kernel update containing the CVE-2024-53197 fix and reboot into the updated kernel. Fixed releases include RHEL 8 kernel 4.18.0-553.44.1.el8_10 and RHEL 7 ELS kernel 3.10.0-1160.133.1.el7; other release streams require their corresponding vendor packages. For affected Android devices, install security patch level 2025-04-07 or later. For affected OpenShift deployments, apply the corresponding fixed release through the supported update channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.