CVE-2024-50302
HID: core: zero-initialize the report buffer
Linux Kernel Use of Uninitialized Resource Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA notes
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/ ; https://source.android.com/docs/security/bulletin/2025-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2024-50302
Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux | 27ce405039bfe6d3f4143415c638f56a3df77dca to <e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 27ce405039bfe6d3f4143415c638f56a3df77dca to <3f9e88f2672c4635960570ee9741778d4135ecf5 27ce405039bfe6d3f4143415c638f56a3df77dca to <d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 27ce405039bfe6d3f4143415c638f56a3df77dca to <05ade5d4337867929e7ef664e7ac8e0c734f1aaf 27ce405039bfe6d3f4143415c638f56a3df77dca to <1884ab3d22536a5c14b17c78c2ce76d1734e8b0b 27ce405039bfe6d3f4143415c638f56a3df77dca to <9d9f5c75c0c7f31766ec27d90f7a6ac673193191 27ce405039bfe6d3f4143415c638f56a3df77dca to <492015e6249fbcd42138b49de3c588d826dd9648 27ce405039bfe6d3f4143415c638f56a3df77dca to <177f25d1292c7e16e1199b39c85480f7f8815552 b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7 fe6c9b48ebc920ff21c10c50ab2729440c734254 3.10.16 to <3.11 3.11.5 to <3.12 |
| Linux | Linux | 3.12 0 to <3.12 (unaffected) 4.19.324 to 4.19.* (unaffected) 5.4.286 to 5.4.* (unaffected) 5.10.230 to 5.10.* (unaffected) 5.15.172 to 5.15.* (unaffected) 6.1.117 to 6.1.* (unaffected) 6.6.61 to 6.6.* (unaffected) 6.11.8 to 6.11.* (unaffected) 6.12 to * (unaffected) |
References
10 Links- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Record Details
More from Linux
Use-after-free in Linux kernel's netfilter: nf_tables component
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
crypto: algif_aead - Revert to operating out-of-place
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.