Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-27436— ALSA: usb-audio: Stop parsing channels bits when all channels are found.

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于找到所有通道后依旧解析通道位。

AI Predicted 7.8 Difficulty: Hard EPSS 0.62% · P49

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 7e2c1b0f6dd9abde9e60f0f9730026714468770f affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 6d5dc96b154be371df0d62ecb07efe400701ed8a affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 5cd466673b34bac369334f66cbe14bb77b7d7827 affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 9af1658ba293458ca6a13f70637b9654fa4be064 affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 629af0d5fe94a35f498ba2c3f19bd78bfa591be6 affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 22cad1b841a63635a38273b799b4791f202ade72 affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< c8a24fd281dcdf3c926413dafbafcf35cde517a9 affected
04324ccc75f96b3ed7aad1c866d1b7925e977bdf< 6d88b289fb0a8d055cb79d1c46a56aba7809d96d affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-27436

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于找到所有通道后依旧解析通道位。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 04324ccc75f96b3ed7aad1c866d1b7925e977bdf ~ 7e2c1b0f6dd9abde9e60f0f9730026714468770f -
Linux Linux 3.8 -

II. Public POCs for CVE-2024-27436

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-27436

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-27436 (2)

Mailing List Discussions for CVE-2024-27436 (2)

Other References for CVE-2024-27436 (7)

Same Patch Batch · Linux · 2024-05-17 · 135 CVEs total

CVE-2023-52687 9.8 CRITICAL crypto: safexcel - Add error handling for dma_map_sg() calls
CVE-2024-35856 8.8 HIGH Bluetooth: btusb: mediatek: Fix double free of skb in coredump
CVE-2024-35804 8.8 HIGH KVM: x86: Mark target gfn of emulated atomic instruction as dirty
CVE-2024-35843 8.8 HIGH iommu/vt-d: Use device rbtree in iopf reporting path
CVE-2024-35811 8.8 HIGH wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
CVE-2024-27415 8.8 HIGH netfilter: bridge: confirm multicast packets before passing them up the stack
CVE-2024-27416 8.8 HIGH Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
CVE-2024-27404 8.2 HIGH mptcp: fix data races on remote_id
CVE-2023-52669 8.2 HIGH crypto: s390/aes - Fix buffer overread in CTR mode
CVE-2024-35834 8.2 HIGH xsk: recycle buffer in case Rx queue was full
CVE-2024-35789 8.0 HIGH wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
CVE-2024-35830 7.8 HIGH media: tc358743: register v4l2 async device only after successful setup
CVE-2024-35835 7.8 HIGH net/mlx5e: fix a double-free in arfs_create_groups
CVE-2024-35827 7.8 HIGH io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
CVE-2023-52662 7.8 HIGH drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
CVE-2024-35817 7.8 HIGH drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
CVE-2024-35808 7.8 HIGH md/dm-raid: don't call md_reap_sync_thread() directly
CVE-2024-35793 7.8 HIGH debugfs: fix wait/cancellation handling during remove
CVE-2024-35798 7.8 HIGH btrfs: fix race in read_extent_buffer_pages()
CVE-2024-35814 7.8 HIGH swiotlb: Fix double-allocation of slots due to broken alignment handling

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-27436

No comments yet

Leave a comment