CVE-2024-50302: Android HID Core Information Disclosure

CVE-2024-50302 Overview

CVE-2024-50302 is an Uninitialized Memory Use vulnerability in the Linux kernel's HID (Human Interface Device) core subsystem. The vulnerability exists because the report buffer used by HID drivers is not zero-initialized during allocation, allowing attackers with local access to potentially leak sensitive kernel memory through specially-crafted HID reports. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Critical Impact
This vulnerability enables kernel memory information disclosure through uninitialized HID report buffers, potentially exposing sensitive data such as cryptographic keys, memory addresses useful for ASLR bypass, or other privileged information. Active exploitation has been confirmed by CISA.

Affected Products

Linux Kernel (multiple versions including 6.12 release candidates)
Google Android
Debian Linux 11.0

Discovery Timeline

November 19, 2024 - CVE-2024-50302 published to NVD
November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-50302

Vulnerability Analysis

The vulnerability resides in the HID core subsystem of the Linux kernel, specifically in how report buffers are allocated and managed. When HID drivers allocate report buffers to handle input from various human interface devices (keyboards, mice, game controllers, etc.), the kernel fails to zero-initialize these buffers during allocation. This oversight means that the allocated memory may contain residual data from previous kernel operations.

An attacker with local access can exploit this weakness by crafting malicious HID reports that trigger the kernel to read from uninitialized portions of the report buffer. The contents of this uninitialized memory can then be transmitted back to the attacker, potentially revealing sensitive kernel memory contents. This type of information disclosure can serve as a stepping stone for more severe attacks, such as bypassing kernel Address Space Layout Randomization (ASLR) or extracting cryptographic material.

Root Cause

The root cause is a CWE-908 (Use of Uninitialized Resource) vulnerability where the HID core subsystem allocates report buffers without performing zero-initialization. The report buffer is shared across multiple HID drivers that interact with it in various ways, and the absence of initialization guarantees creates an exploitable condition where stale memory contents can be accessed and leaked.

Attack Vector

The attack requires local access to the target system. An attacker can exploit this vulnerability by connecting a malicious HID device (physical or emulated) or by leveraging existing HID driver functionality to trigger buffer operations that expose uninitialized memory. Since HID devices are commonly trusted and auto-enumerated by modern operating systems, this attack surface can be particularly dangerous in scenarios involving:

Malicious USB devices (BadUSB-style attacks)
Virtual HID device emulation
Compromised user-space applications interacting with HID subsystem

The vulnerability does not require any user interaction and can be exploited by a low-privileged local attacker. The attack does not affect system integrity or availability—it is purely an information disclosure issue.

Detection Methods for CVE-2024-50302

Indicators of Compromise

Unusual HID device enumeration events, particularly from unrecognized or unexpected devices
Anomalous HID report sizes or patterns that deviate from expected device behavior
Kernel log messages indicating HID driver errors or unexpected buffer operations
Presence of suspicious USB devices or virtual HID interfaces not associated with legitimate hardware

Detection Strategies

Monitor kernel logs (dmesg) for HID-related anomalies or error messages that may indicate exploitation attempts
Implement USB device allowlisting to prevent unauthorized HID devices from being enumerated
Deploy endpoint detection solutions capable of monitoring HID subsystem activity and USB device connections
Use kernel auditing facilities to track HID driver operations and report buffer access patterns

Monitoring Recommendations

Enable comprehensive logging for USB device connections and HID driver initialization events
Configure SentinelOne agents to monitor for suspicious HID device activity and potential exploitation indicators
Implement real-time alerting for unexpected HID device enumeration, especially in server environments where such devices are uncommon
Review system logs regularly for patterns consistent with memory disclosure exploitation attempts

How to Mitigate CVE-2024-50302

Immediate Actions Required

Apply the latest kernel security patches from your Linux distribution immediately, as this vulnerability is actively exploited
Restrict physical access to systems and disable unnecessary USB ports where feasible
Implement USB device allowlisting to prevent unauthorized HID devices from connecting
Review and update Android devices to the latest security patch level

Patch Information

The Linux kernel development team has released patches to address this vulnerability by ensuring report buffers are zero-initialized during allocation. Multiple commits have been merged into stable kernel branches:

Debian has issued security advisories for Debian 11 LTS users. See the Debian LTS Announcement January 2025 and Debian LTS Announcement March 2025 for distribution-specific patch guidance.

For organizations using Google Android, ensure devices are updated to the latest security patch level that addresses CVE-2024-50302.

Workarounds

Disable USB ports or implement strict USB device access controls using usbguard or similar tools on Linux systems
Use kernel boot parameters to restrict HID device enumeration where operationally feasible
Implement network segmentation and access controls to limit local attacker opportunities
Consider deploying mandatory access control solutions (SELinux, AppArmor) with policies that restrict HID subsystem access

bash

# Example: Install and configure USBGuard to restrict HID devices
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard

# Block new HID devices by default (add to /etc/usbguard/rules.conf)
# allow id 1234:5678 # Whitelist known trusted devices
# reject with-interface equals { 03:*:* } # Reject HID class devices by default