Security readout for executives and security teams
Plain-English summary
A malicious or bogus USB audio device can trigger out-of-bounds memory access in the Linux kernel's USB audio handling. Successful exploitation could affect confidentiality, integrity, and availability. Because CISA lists this CVE in KEV, treat it as actively exploited and prioritize exposed Linux systems.
Executive priority
High. This is a kernel memory-safety issue with high potential impact and CISA KEV status. Prioritize Linux endpoints and physically accessible systems first, then complete standard kernel patching across the fleet.
Technical view
The flaw is in ALSA usb-audio handling for Extigy and Mbox-related paths. A device can report a bNumConfigurations value larger than the allocation made by usb_get_configuration, causing later out-of-bounds access such as during usb_destroy_configuration. The CVSS vector is local, low complexity, low privileges, no user interaction, with high CIA impact.
Likely exposure
Exposure is most relevant for Linux systems running affected kernel versions that allow local users or environments to attach USB devices, especially workstations, kiosks, labs, and servers with accessible USB ports. Systems without practical USB device exposure still require kernel review, but immediate exploitation paths are less clear from the bundle.
Exploitation context
CISA KEV listing supports active exploitation status. The provided sources do not include exploit details, public proof-of-concept information, or observed campaign context. The attack surface appears local and device-mediated, based on the CVSS vector and kernel description.
Researcher notes
The bundle supports an out-of-bounds access in Linux ALSA usb-audio caused by inconsistent USB configuration counts. Evidence identifies stable kernel fixes and Debian LTS advisories, but does not provide exploit mechanics, affected distro package ranges beyond listed kernel versions, or campaign details.
Mitigation direction
- Apply vendor or distribution kernel updates containing the stable fixes.
- Review Debian LTS advisories if running Debian-based systems.
- Restrict use of untrusted USB devices on Linux systems.
- Physically control USB access on high-risk endpoints and kiosks.
- Reboot systems after kernel updates where required.
- Track remediation under KEV-driven vulnerability management.
Validation and detection
- Inventory Linux kernel versions across endpoints and servers.
- Check whether affected systems allow USB audio devices.
- Confirm installed kernels include the referenced stable commits or vendor backports.
- Verify patched systems boot into the updated kernel.
- Review asset priority for public, shared, or physically accessible systems.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 0b4ea4bfe16566b84645ded1403756a2dc4e0f19
- Linux stable commit 9b8460a2a7ce478e0b625af7c56d444dc24190f7
- Linux stable commit 62dc01c83fa71e10446ee4c31e0e3d5d1291e865
- Linux stable commit 9887d859cd60727432a01564e8f91302d361b72b
- Linux stable commit 920a369a9f014f10ec282fd298d0666129379f1b
- Linux stable commit b8f8b81dabe52b413fe9e062e8a852c48dd0680d
- Linux stable commit 379d3b9799d9da953391e973b934764f01e03960
- Linux stable commit b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca
- Linux stable commit b909df18ce2a998afef81d58bbd1a05dc0788c40
- CISA Known Exploited Vulnerabilities Catalog
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-53197 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-04-09T00:00:00.000Z: CVE-2024-53197 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19CVE reference, Linux
- https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7CVE reference, Linux
- https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865CVE reference, Linux
- https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72bCVE reference, Linux
- https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1bCVE reference, Linux
- https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680dCVE reference, Linux
- https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960CVE reference, Linux
- https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bccaCVE reference, Linux
- https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40CVE reference, Linux
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197CVE reference, CISA-ADP · government-resource
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.