CVE-2024-50302
HID: core: zero-initialize the report buffer
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Linux Kernel Use of Uninitialized Resource Vulnerability.
- Added
- 4 Mar 2025
- Fix due (US federal)
- 25 Mar 2025
- Used by ransomware
- Not known
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.
Timeline
ID reserved
By Linux
- 29 days later
· 29 days later
Published
- 4 months later
· 4 months later
Added to CISA KEV
Known exploited in the wild
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.81% · top 43% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 3f9e88f2672c4635960570ee9741778d4135ecf5
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 05ade5d4337867929e7ef664e7ac8e0c734f1aaf
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 9d9f5c75c0c7f31766ec27d90f7a6ac673193191
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 492015e6249fbcd42138b49de3c588d826dd9648
- affected 27ce405039bfe6d3f4143415c638f56a3df77dca – < 177f25d1292c7e16e1199b39c85480f7f8815552
- affected b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7
- affected fe6c9b48ebc920ff21c10c50ab2729440c734254
- affected 3.10.16 – < 3.11
- affected 3.11.5 – < 3.12
- affected 3.12
- unaffected < 3.12
- unaffected 4.19.324 – ≤ 4.19.*
- unaffected 5.4.286 – ≤ 5.4.*
- unaffected 5.10.230 – ≤ 5.10.*
- unaffected 5.15.172 – ≤ 5.15.*
- unaffected 6.1.117 – ≤ 6.1.*
- unaffected 6.6.61 – ≤ 6.6.*
- unaffected 6.11.8 – ≤ 6.11.*
- unaffected 6.12 – ≤ *
References (13)
- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 (opens in a new tab)
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5 (opens in a new tab)
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 (opens in a new tab)
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf (opens in a new tab)
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b (opens in a new tab)
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191 (opens in a new tab)
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648 (opens in a new tab)
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552 (opens in a new tab)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302 (opens in a new tab)government-resource
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-50302)Record last updated .