Analytical use of cookies
CVE-2024-50302: Linux Kernel Use of Uninitialized Resource Vulnerability
CVE-2024-50302: medium vulnerability affecting Kernel. Check CVSS, KEV status, business impact and recommended administrator actions.
- CVSS
- 5.5 MEDIUM
- EPSS
- 53.22%
- Known exploited
- yes
- Product
- Kernel
What is known
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Business impact
Successful exploitation of CVE-2024-50302, a medium vulnerability (CVSS 5.5) affecting Kernel, may affect the confidentiality, integrity or availability of the vulnerable environment. The exact impact depends on the installed version, exposed interfaces and deployment configuration. CISA lists this vulnerability in the Known Exploited Vulnerabilities catalog, so exposed systems should be treated as a priority.
Recommended administrator action
Confirm whether Kernel is present and compare installed versions with the vendor advisory and NVD record. Apply the vendor patch or documented mitigation; until remediation is complete, reduce exposure of affected interfaces, review relevant logs and monitor for indicators of exploitation. Where applicable, include the CISA KEV remediation due date of 2025-03-25 in the change plan. DataHouse can support version verification, managed patching, network exposure reduction, log review and backup validation for dedicated, cloud and colocated environments.