CVE-2024-50302

Published Nov 19, 2024

Last updated 4 months ago

Exploit known CVSS medium 5.5

Linux

Mobile device

Overview

Description: In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Analyzed
Products: android, debian_linux, linux_kernel

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Linux Kernel Use of Uninitialized Resource Vulnerability
Exploit added on: Mar 4, 2025
Exploit action due: Mar 25, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-908
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-908

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7D982986-F7AE-4B56-8E3E-D34CE2B7AF38",
            "versionEndExcluding": "4.19.324",
            "versionStartIncluding": "3.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9952C897-8A61-4D4B-9D6D-7D063E9EA15E",
            "versionEndExcluding": "5.4.286",
            "versionStartIncluding": "4.20",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BF5B32D0-72C9-41C3-A0BB-D4946153C134",
            "versionEndExcluding": "5.10.230",
            "versionStartIncluding": "5.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "88812664-4296-42AC-AE0F-ED71086C1BB1",
            "versionEndExcluding": "5.15.172",
            "versionStartIncluding": "5.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0DD7F755-2F6B-4707-8973-78496AD5AA8E",
            "versionEndExcluding": "6.1.117",
            "versionStartIncluding": "5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "630ED7EB-C97E-4435-B884-1E309E40D6F3",
            "versionEndExcluding": "6.6.61",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0BD000F7-3DAD-4DD3-8906-98EA1EC67E95",
            "versionEndExcluding": "6.11.8",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*",
            "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References