CVE-2024-50302
Linux Kernel Use of Uninitialized Resource Vulnerability
Description
CVE-2024-50302 is a medium-severity information disclosure vulnerability in the Linux kernel's HID (Human Interface Device) core subsystem caused by an uninitialized report buffer that can leak kernel memory. The vulnerability exists because the HID report buffer is allocated without zero-initialization, allowing a specially crafted HID device report to trigger reads of uninitialized memory, potentially exposing sensitive kernel data. With a CVSS v3.1 base score of 5.5, CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 25, 2025. The EPSS score of 1.32% at the 80th percentile indicates meaningful exploitation probability, and the vulnerability affects Linux kernel versions spanning from 3.12 through 6.12.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | - | |
| debian | debian linux | 11.0 |
| siemens | simatic s7-1500 tm mfp firmware | - |
| siemens | sinec os | < 3.2 |
| linux | linux kernel | >= 3.12, < 4.19.324; >= 4.20, < 5.4.286; >= 5.5, < 5.10.230; >= 5.11, < 5.15.172; >= 5.16, < 6.1.117; >= 6.2, < 6.6.61; >= 6.7, < 6.11.8; 6.12 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf(Patch)
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552(Patch)
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b(Patch)
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5(Patch)
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648(Patch)
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191(Patch)
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46(Patch)
- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26(Patch)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html(Mailing List)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302(US Government Resource)
Weakness Type
CWE-908: Use of Uninitialized Resource
CVE-2024-50302 is caused by the use of an uninitialized resource — specifically, a heap-allocated buffer in the Linux kernel's HID core that is not zero-initialized before use. When memory is allocated without initialization, it retains whatever data previously occupied that memory region, which may include sensitive kernel data such as pointers, credentials, or cryptographic material. A specially crafted HID device report can exploit this by triggering a read of the uninitialized buffer contents, leaking kernel memory to user space or to the device.
Learn more: CWE-908 — Use of Uninitialized Resource
Impact Analysis
CVE-2024-50302 poses a significant risk to systems running affected Linux kernel versions, particularly those that process HID device input. The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), requiring no user interaction (UI:N). Confidentiality (High): The uninitialized buffer can leak sensitive kernel memory contents, including kernel addresses useful for defeating KASLR (Kernel Address Space Layout Randomization), cryptographic keys, and fragments of data from other kernel subsystems. This information can serve as a foundation for more sophisticated kernel exploitation. Integrity and Availability: The CVSS scoring indicates no direct integrity or availability impact (I:N/A:N), as the vulnerability is limited to information disclosure. However, the leaked kernel addresses and data significantly lower the bar for follow-up attacks targeting kernel code execution. The vulnerability is particularly concerning for Android devices, as Google has confirmed the flaw affects Android systems. The confirmed active exploitation tracked by CISA, combined with the broad range of affected kernel versions (3.12 through 6.12), means millions of Linux systems and Android devices are potentially at risk.
Exploit Maturity
CVE-2024-50302 has confirmed active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, mandating remediation by March 25, 2025. While the ransomware association is currently listed as unknown, the vulnerability's value as an information leak primitive for bypassing kernel memory protections makes it attractive to sophisticated attackers building exploit chains. The EPSS score of 1.32% at the 80th percentile indicates exploitation activity above the vast majority of tracked vulnerabilities. Multiple patches have been released across the stable Linux kernel branches, with commits available in the kernel git repository. Debian has also published advisories addressing the vulnerability for Debian 11 (Bullseye).
Remediation
-
Update the Linux kernel immediately. Apply the patches released for the affected kernel branches. The fix zero-initializes the HID report buffer during allocation. Updated versions include: 4.19.324+, 5.4.286+, 5.10.230+, 5.15.172+, 6.1.117+, 6.6.61+, 6.11.8+, and 6.12+. Select the appropriate patched version for your kernel branch.
-
Update Android devices. Google has confirmed CVE-2024-50302 affects Android. Apply the latest Android security updates that include the kernel patch. For devices no longer receiving updates, consider upgrading to a supported device or applying custom kernel patches.
-
Apply distribution-specific updates. Debian users should apply the updates referenced in Debian LTS announcements. Other distributions including Ubuntu, Red Hat, and SUSE have released corresponding kernel updates that should be applied through standard package management.
-
Restrict HID device access on sensitive systems. On high-security systems, use USB device whitelisting (via udev rules or USBGuard) to prevent unauthorized HID devices from connecting. This reduces the attack surface for exploitation through malicious or crafted USB devices.
-
Monitor for kernel memory leak indicators. Review system logs for unusual HID device activity and implement kernel integrity monitoring. Consider enabling additional kernel hardening options such as CONFIG_INIT_ON_ALLOC_DEFAULT_ON to zero-initialize heap allocations by default, providing defense in depth against similar uninitialized memory vulnerabilities.
Technical Details
CVE-2024-50302 is a kernel memory information disclosure vulnerability in the Linux HID (Human Interface Device) core subsystem. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects local access with low privileges and high confidentiality impact without integrity or availability effects. The root cause is in the HID report buffer allocation path, where the buffer used to store HID device reports is allocated using kmalloc() without subsequent zeroing. Since the HID report buffer is shared across multiple drivers and used in various ways throughout the HID subsystem, the uninitialized contents — which reflect whatever data previously occupied that heap memory — can be exposed through crafted HID device reports. The fix, implemented across eight stable kernel branches, replaces the non-zeroing allocation with kzalloc() (or equivalent zero-initialization), ensuring the buffer starts with all zeros regardless of prior memory contents. The attack vector requires a locally connected HID device (physical or virtual) that sends specially crafted reports designed to trigger reads of the uninitialized portions of the buffer. This is particularly effective on systems that allow USB device connection, as a malicious USB HID device can be designed to exploit the vulnerability without requiring any user authentication or interaction beyond physical device connection.
Frequently Asked Questions
Is CVE-2024-50302 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2024-50302 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 25, 2025. The vulnerability is particularly concerning because it affects a wide range of Linux kernel versions from 3.12 through 6.12 and also impacts Android devices.
What Linux kernel versions are affected by CVE-2024-50302?
CVE-2024-50302 affects Linux kernel versions from 3.12 through 6.12, spanning nearly a decade of kernel releases. Specifically, all versions before the following patched releases are vulnerable: 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, and the final 6.12 release.
Does CVE-2024-50302 affect Android devices?
Yes. Google has confirmed that CVE-2024-50302 affects Android, as Android uses the Linux kernel and includes the vulnerable HID core subsystem. Users should apply the latest Android security updates to remediate this vulnerability.
How do I fix CVE-2024-50302?
Update your Linux kernel to a patched version for your branch (e.g., 6.6.61+ for the 6.6 series, 6.1.117+ for the 6.1 series). For distribution-managed kernels, apply updates through your package manager. The fix zero-initializes the HID report buffer to prevent kernel memory leakage.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.