ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

Open Source Vulnerabilities ASB-A-382243530

In multiple functions of quirks.c, there is a possible way to free arbitrary memory due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Open Source Vulnerabilities CVE-2024-53197

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.

Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities CVE-2024-53197

Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.