CVE-2024-50302

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50302
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf Patch
https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552 Patch
https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b Patch
https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5 Patch
https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648 Patch
https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191 Patch
https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 Patch
https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
History

04 Nov 2025, 14:36

Type Values Removed Values Added
First Time Debian debian Linux
Debian
References () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html - () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html - () https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html - Mailing List
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

03 Nov 2025, 23:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

03 Nov 2025, 21:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html -

24 Oct 2025, 20:48

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 - US Government Resource

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:20

Type Values Removed Values Added
First Time Google
Google android
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 -
CPE cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

27 Nov 2024, 15:27

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf - () https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf - Patch
References () https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552 - () https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552 - Patch
References () https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b - () https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b - Patch
References () https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5 - () https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5 - Patch
References () https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648 - () https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648 - Patch
References () https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191 - () https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191 - Patch
References () https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 - () https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 - Patch
References () https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 - () https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-908

19 Nov 2024, 21:57

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: núcleo: inicializar en cero el búfer de informes Dado que el búfer de informes es utilizado por todo tipo de controladores de diversas formas, vamos a inicializarlo en cero durante la asignación para asegurarnos de que nunca pueda usarse para filtrar memoria del kernel a través de un informe especialmente manipulado.

19 Nov 2024, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-19 02:16

Updated : 2025-11-04 14:36

NVD link : CVE-2024-50302

Mitre link : CVE-2024-50302

CVE.ORG link : CVE-2024-50302

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel

google

  • android
CWE
CWE-908

Use of Uninitialized Resource