CVE-2024-50302
Linux · published 2024-11-19
Source record Collected from the National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities
CISA lists this CVE as known exploited (added 2025-03-04).
- CISA's name for it: Linux Kernel Use of Uninitialized Resource Vulnerability
- CISA's description: The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.
- Known ransomware campaign use, per CISA: Unknown
Source: CISA KEV catalog (CC0 1.0).
Description
Description by kernel.org via the CVE Program.
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Filed by kernel.org; not a statement by Linux.
Status at the source
- NVD status: Analyzed
Affected products, as the source lists them
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 27ce405039bfe6d3f4143415c638f56a3df77dca – before e7ea60184e1e88a3c9e437b3265cbb6439aa7e26: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 3f9e88f2672c4635960570ee9741778d4135ecf5: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before d7dc68d82ab3fcfc3f65322465da3d7031d4ab46: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 05ade5d4337867929e7ef664e7ac8e0c734f1aaf: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 9d9f5c75c0c7f31766ec27d90f7a6ac673193191: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 492015e6249fbcd42138b49de3c588d826dd9648: affected 27ce405039bfe6d3f4143415c638f56a3df77dca – before 177f25d1292c7e16e1199b39c85480f7f8815552: affected b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7: affected fe6c9b48ebc920ff21c10c50ab2729440c734254: affected 3.10.16 – before 3.11: affected 3.11.5 – before 3.12: affected |
| Linux | Linux | 3.12: affected 0 – before 3.12: unaffected 4.19.324 – 4.19.* and earlier: unaffected 5.4.286 – 5.4.* and earlier: unaffected 5.10.230 – 5.10.* and earlier: unaffected 5.15.172 – 5.15.* and earlier: unaffected 6.1.117 – 6.1.* and earlier: unaffected 6.6.61 – 6.6.* and earlier: unaffected 6.11.8 – 6.11.* and earlier: unaffected 6.12 – * and earlier: unaffected |
Added by siemens-SADP (Authorized Data Publisher)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | RUGGEDCOM RST2428P | 0 – before *: unaffected |
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family | 0 – before *: unaffected |
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family | 0 – before *: unaffected |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | 0 – before *: affected |
Products named in NVD's CPE match criteria (5)
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
DeSpy has not checked any unit, hardware revision or firmware. A product missing here is not a statement that it is unaffected.
Scores, as their sources published them
- CVSS 3.1: 5.5 MEDIUM — as published by NIST (Primary)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1: 5.5 MEDIUM — as published by CISA-ADP (Secondary)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - SSVC — CISA's assessment (SSVC 2.0.3, CISA Coordinator): Exploitation: active · Automatable: no · Technical impact: partial
DeSpy does not score records. These are the sources' own values.
Weaknesses
Sources
References the source lists
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302
Source dates: published 2024-11-19, last changed 2026-06-17. DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.