CVE-2024-50302: Android HID Core Information Disclosure

CVE-2024-50302 Overview

CVE-2024-50302 is an Uninitialized Memory Use vulnerability in the Linux kernel's HID (Human Interface Device) core subsystem. The vulnerability exists because the report buffer used by HID drivers is not zero-initialized during allocation, allowing attackers with local access to potentially leak sensitive kernel memory through specially-crafted HID reports. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Critical Impact

This vulnerability enables kernel memory information disclosure through uninitialized HID report buffers, potentially exposing sensitive data such as cryptographic keys, memory addresses useful for ASLR bypass, or other privileged information. Active exploitation has been confirmed by CISA.

Affected Products

• Linux Kernel (multiple versions including 6.12 release candidates)
• Google Android
• Debian Linux 11.0

Discovery Timeline

• November 19, 2024 - CVE-2024-50302 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-50302

Vulnerability Analysis

The vulnerability resides in the HID core subsystem of the Linux kernel, specifically in how report buffers are allocated and managed. When HID drivers allocate report buffers to handle input from various human interface devices (keyboards, mice, game controllers, etc.), the kernel fails to zero-initialize these buffers during allocation. This oversight means that the allocated memory may contain residual data from previous kernel operations.

An attacker with local access can exploit this weakness by crafting malicious HID reports that trigger the kernel to read from uninitialized portions of the report buffer. The contents of this uninitialized memory can then be transmitted back to the attacker, potentially revealing sensitive kernel memory contents. This type of information disclosure can serve as a stepping stone for more severe attacks, such as bypassing kernel Address Space Layout Randomization (ASLR) or extracting cryptographic material.

Root Cause

The root cause is a CWE-908 (Use of Uninitialized Resource) vulnerability where the HID core subsystem allocates report buffers without performing zero-initialization. The report buffer is shared across multiple HID drivers that interact with it in various ways, and the absence of initialization guarantees creates an exploitable condition where stale memory contents can be accessed and leaked.

Attack Vector

The attack requires local access to the target system. An attacker can exploit this vulnerability by connecting a malicious HID device (physical or emulated) or by leveraging existing HID driver functionality to trigger buffer operations that expose uninitialized memory. Since HID devices are commonly trusted and auto-enumerated by modern operating systems, this attack surface can be particularly dangerous in scenarios involving:

• Malicious USB devices (BadUSB-style attacks)
• Virtual HID device emulation
• Compromised user-space applications interacting with HID subsystem

The vulnerability does not require any user interaction and can be exploited by a low-privileged local attacker. The attack does not affect system integrity or availability—it is purely an information disclosure issue.

Detection Methods for CVE-2024-50302

Indicators of Compromise

• Unusual HID device enumeration events, particularly from unrecognized or unexpected devices
• Anomalous HID report sizes or patterns that deviate from expected device behavior
• Kernel log messages indicating HID driver errors or unexpected buffer operations
• Presence of suspicious USB devices or virtual HID interfaces not associated with legitimate hardware

Detection Strategies

• Monitor kernel logs (dmesg) for HID-related anomalies or error messages that may indicate exploitation attempts
• Implement USB device allowlisting to prevent unauthorized HID devices from being enumerated
• Deploy endpoint detection solutions capable of monitoring HID subsystem activity and USB device connections
• Use kernel auditing facilities to track HID driver operations and report buffer access patterns

Monitoring Recommendations

• Enable comprehensive logging for USB device connections and HID driver initialization events
• Configure SentinelOne agents to monitor for suspicious HID device activity and potential exploitation indicators
• Implement real-time alerting for unexpected HID device enumeration, especially in server environments where such devices are uncommon
• Review system logs regularly for patterns consistent with memory disclosure exploitation attempts

How to Mitigate CVE-2024-50302

Immediate Actions Required

• Apply the latest kernel security patches from your Linux distribution immediately, as this vulnerability is actively exploited
• Restrict physical access to systems and disable unnecessary USB ports where feasible
• Implement USB device allowlisting to prevent unauthorized HID devices from connecting
• Review and update Android devices to the latest security patch level

Patch Information

The Linux kernel development team has released patches to address this vulnerability by ensuring report buffers are zero-initialized during allocation. Multiple commits have been merged into stable kernel branches:

• Kernel Commit 05ade5d4337867929e7ef664e7ac8e0c734f1aaf
• Kernel Commit 177f25d1292c7e16e1199b39c85480f7f8815552
• Kernel Commit d7dc68d82ab3fcfc3f65322465da3d7031d4ab46

Debian has issued security advisories for Debian 11 LTS users. See the Debian LTS Announcement January 2025 and Debian LTS Announcement March 2025 for distribution-specific patch guidance.

For organizations using Google Android, ensure devices are updated to the latest security patch level that addresses CVE-2024-50302.

Workarounds

• Disable USB ports or implement strict USB device access controls using usbguard or similar tools on Linux systems
• Use kernel boot parameters to restrict HID device enumeration where operationally feasible
• Implement network segmentation and access controls to limit local attacker opportunities
• Consider deploying mandatory access control solutions (SELinux, AppArmor) with policies that restrict HID subsystem access

# Example: Install and configure USBGuard to restrict HID devices
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard

# Block new HID devices by default (add to /etc/usbguard/rules.conf)
# allow id 1234:5678 # Whitelist known trusted devices
# reject with-interface equals { 03:*:* } # Reject HID class devices by default