CVE-2024-27436

MEDIUM

Linux Kernel - Out-of-bounds Write in ALSA USB Audio Channel Parsing

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.

References (12)

Core 12
Core References

Scores

CVSS v3 5.5
EPSS 0.0017
EPSS Percentile 38.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (30)
debian/debian_linux 10.0
linux/Kernel 3.8.0 - 4.19.311linux
linux/Kernel 4.20.0 - 5.4.273linux
linux/Kernel 5.11.0 - 5.15.153linux
linux/Kernel 5.16.0 - 6.1.83linux
linux/Kernel 5.5.0 - 5.10.214linux
linux/Kernel 6.2.0 - 6.6.23linux
linux/Kernel 6.7.0 - 6.7.11linux
linux/Kernel 6.8.0 - 6.8.2linux
Linux/Linux < 3.8
... and 20 more
Published May 17, 2024
Tracked Since Feb 18, 2026