CVE-2024-53150: Linux Kernel Clock.c Out of Bounds Read Vulnerability
Summary
CVE-2024-53150: In validate_clock_selector of clock.c, there is a possible out of bounds read due to memory corruption. Affects :linux_kernel: versions >= :0, < :2025-04-05. Fixed in :2025-04-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2024-53150 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. The vulnerability in question arises from the 'validate_clock_selector' function within the 'clock.c' file, which is part of the USB sound subsystem. This vulnerability can lead to memory corruption, potentially exposing sensitive information.
Vulnerability Detail
In the 'validate_clock_selector' function of 'clock.c', there exists a flaw that allows for a possible out of bounds read due to memory corruption. This vulnerability can lead to local information disclosure without requiring additional execution privileges. Exploitation does not necessitate user interaction, making it a significant security concern.
How To Fix
Minimum fixed version
:2025-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2024-53150 vulnerability in the Linux Kernel's 'clock.c' file poses a significant risk due to its potential for local information disclosure. Users are strongly advised to update their systems to the patched version to mitigate this risk.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2024-53150 is a vulnerability in the Linux Kernel's 'clock.c' file that allows for an out of bounds read due to memory corruption.
The vulnerability can lead to local information disclosure, potentially exposing sensitive data without requiring additional execution privileges.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can update your Linux Kernel through your operating system's package manager or by applying the patches available at the provided links.
No, user interaction is not needed for exploitation, making it a more critical security issue.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
