CVE-2024-50302

MediumCVSS 5.5/10Known exploited (CISA KEV)Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: zero-initialize the report buffer

Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

VendorProductVersions
LinuxLinux>= 27ce405039bfe6d3f4143415c638f56a3df77dca, < e7ea60184e1e88a3c9e437b3265cbb6439aa7e26; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 3f9e88f2672c4635960570ee9741778d4135ecf5; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < d7dc68d82ab3fcfc3f65322465da3d7031d4ab46; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 05ade5d4337867929e7ef664e7ac8e0c734f1aaf; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 9d9f5c75c0c7f31766ec27d90f7a6ac673193191; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 492015e6249fbcd42138b49de3c588d826dd9648; >= 27ce405039bfe6d3f4143415c638f56a3df77dca, < 177f25d1292c7e16e1199b39c85480f7f8815552; b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7; fe6c9b48ebc920ff21c10c50ab2729440c734254; >= 3.10.16, < 3.11; >= 3.11.5, < 3.12
LinuxLinux3.12
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
Nov 19, 2024
Last modified
Oct 15, 2026
Added to CISA KEV
Mar 4, 2025
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-503035.5In the Linux kernel, the following vulnerability has been resolved: resource,kexec: walk_system_ram_res_rev must retain resource flags walCVE-2024-503045.5In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() CVE-2024-503057.5Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 thCVE-2024-503069.1Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.CVE-2024-503075.5Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. If a user clicks a speCVE-2024-50316.4The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via thCVE-2024-503107.5A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions >= V4.0.44 < V4.0.50). Affected devices do CVE-2024-503116.5A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. ThCVE-2024-503125.3A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized usersCVE-2024-503135.3A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by theCVE-2024-503177.5A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.CVE-2024-503187.5A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.