CVE-2024-50302

CVE-2024-50302 is a use of uninitialized resource flaw (CWE-908) in the Linux kernel's HID (Human Interface Device) core, where the shared report buffer was not zero-initialized at allocation. An attacker can trigger it by getting the kernel to process a specially crafted HID report, causing uninitialized kernel memory to be exposed to the requesting driver. The impact is an information disclosure: a local attacker, or a malicious/malfunctioning HID device, could leak kernel memory contents, which could in turn aid further attacks. Because nearly all Linux-based systems compile in HID support, affected code is present in Linux distributions, Android, and Siemens industrial products (SIMATIC S7-1500 TM MFP firmware and SINEC OS). The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2025-03-04, and it is among the actively exploited flaws addressed in Google's March 2025 Android security update.

What to do: Apply the fixes per vendor channels: install the March 2025 Android security update on Android devices (it is listed as actively exploited and is in CISA KEV, required under BOD 22-01 for federal agencies), and apply Debian kernel updates and Siemens (SIMATIC S7-1500 TM MFP firmware / SINEC OS) updates once issued. Operators should inventory systems running Linux kernels with the HID core (most systems) and prioritize patching, since a local attacker or malicious USB HID device can leak kernel memory; the fix zero-initializes the HID report buffer and is included in current stable kernel branches.