NetSight
IP …
medium5.5Known exploited

CVE-2024-50302

Linux Kernel Use of Uninitialized Resource Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-03-04. Federal due date: 2025-03-25.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Affected products

VendorProductAffected versions
GoogleAndroid
All versions
DebianDebian Linux
Version 11.0
SiemensSimatic S7-1500 Tm Mfp Firmware
All versions
SiemensSinec Os
before 3.2
LinuxLinux Kernel
from 3.12 before 4.19.324
from 4.20 before 5.4.286
from 5.5 before 5.10.230
from 5.11 before 5.15.172
from 5.16 before 6.1.117
from 6.2 before 6.6.61

Weakness classification

CWE-908

References