Coverage › CVE-2024-53150

CVE-2024-53150 Mapped Partial Sigma

Linux Kernel Out-of-Bounds Read Vulnerability

Vendor / product

Linux — Kernel

Description (CISA)

Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.

Added to KEV

2025-04-09

Due date

2025-04-30

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-125

CISA notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024122427-CVE-2024-53150-3a7d@gregkh/
https://source.android.com/docs/security/bulletin/2025-04-01
https://nvd.nist.gov/vuln/detail/CVE-2024-53150

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System primary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1011 Exfiltration Over Other Network Medium secondary impact

• DET0077 Detection of Exfiltration Over Alternate Network Interfaces
  AN0212 Windows

  Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:System EventCode=5005 (WLAN), EventCode=302 (Bluetooth) → DC0085 Network Traffic Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: InterfaceType FileSizeThreshold TimeWindow
  AN0213 Linux

  Use of rfkill, nmcli, or low-level tools (e.g., iw, hcitool, pppd) to enable alternate interfaces followed by data transfer via non-primary NICs.

  auditd:SYSCALL None → DC0064 Command Execution

  NSM:Flow None → DC0078 Network Traffic Flow

  Tunable: CommandPattern NetworkDevice
  AN0214 macOS

  AppleScript or system calls to activate WiFi/Bluetooth interfaces (networksetup, blueutil), followed by exfiltration via AirDrop, cloud sync, or network socket.

  macos:unifiedlog None → DC0085 Network Traffic Content

  macos:osquery process_events → DC0032 Process Creation

  macos:osquery interface_details → DC0018 Host Status

  Tunable: Protocol InterfaceActivityWindow

Sigma rules tagged attack.t1011 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1091 Replication Through Removable Media exploitation technique

• DET0301 Removable Media Execution Chain Detection via File and Process Activity
  AN0841 Windows

  Execution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools.

  WinEventLog:System EventCode=1006 → DC0042 Drive Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Microsoft-Windows-Windows Defender/Operational Suspicious file execution on removable media path → DC0055 File Access

  Tunable: DriveLetterMatch FileExecutionWindow ParentProcess FileEntropy

Sigma rules tagged attack.t1091 (1)