In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/T
This has been added to the CISAs "Known Exploited Vulnerabilities" list. Any plans to address this in supported RHELs? https://www.cisa.gov/news-events/alerts/2025/04/09/cisa-adds-two-known-exploited-vulnerabilities-catalog
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:3827 https://access.redhat.com/errata/RHSA-2025:3827
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2025:3832 https://access.redhat.com/errata/RHSA-2025:3832
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:3839 https://access.redhat.com/errata/RHSA-2025:3839
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:3838 https://access.redhat.com/errata/RHSA-2025:3838
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Via RHSA-2025:3861 https://access.redhat.com/errata/RHSA-2025:3861
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Via RHSA-2025:3871 https://access.redhat.com/errata/RHSA-2025:3871
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:3880 https://access.redhat.com/errata/RHSA-2025:3880
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:3887 https://access.redhat.com/errata/RHSA-2025:3887
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:3889 https://access.redhat.com/errata/RHSA-2025:3889
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:3888 https://access.redhat.com/errata/RHSA-2025:3888
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:3894 https://access.redhat.com/errata/RHSA-2025:3894
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:3893 https://access.redhat.com/errata/RHSA-2025:3893
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:3901 https://access.redhat.com/errata/RHSA-2025:3901
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Via RHSA-2025:3903 https://access.redhat.com/errata/RHSA-2025:3903
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Via RHSA-2025:3931 https://access.redhat.com/errata/RHSA-2025:3931
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3935 https://access.redhat.com/errata/RHSA-2025:3935
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:3937 https://access.redhat.com/errata/RHSA-2025:3937
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4019 https://access.redhat.com/errata/RHSA-2025:4019
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:4012 https://access.redhat.com/errata/RHSA-2025:4012
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:4177 https://access.redhat.com/errata/RHSA-2025:4177
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2025:4409 https://access.redhat.com/errata/RHSA-2025:4409
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:4422 https://access.redhat.com/errata/RHSA-2025:4422