ZeroDay Findings
Sign inSign up

Findings

CVE-2024-50302

Linux Kernel Use of Uninitialized Resource Vulnerability

Published Nov 18, 2024 · updated Jun 17, 2026 · google android

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 18, 2024 · Catalog

    Detected

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

  2. Mar 4, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Mar 25, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Mar 25, 2025

Affected

  • cpe debian/debian linux11.0
  • cpe google/androidversion unspecified
  • cpe linux/linux kernelversion unspecified
  • cpe siemens/simatic s7-1500 tm mfp firmwareversion unspecified
  • cpe siemens/sinec osversion unspecified
  • vendor Linux Kernelversion unspecified

Sources

  • CISA KEVCVE-2024-50302

    The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.

    cisa.gov
  • CVE.orgCVE-2024-50302

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-50302

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDCVE-2024-50302

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak k

    nvd.nist.gov

References