Security readout for executives and security teams
Plain-English summary
CVE-2024-50302 is a Linux kernel information disclosure flaw in HID handling. A specially crafted HID report could expose kernel memory because a report buffer was not zero-initialized. The base severity is medium, but CISA KEV listing raises urgency because exploitation is documented there.
Executive priority
Treat as urgent for Linux fleets because CISA KEV indicates real-world exploitation. It is not a remote takeover issue in the provided evidence, but kernel memory disclosure can support broader compromise chains.
Technical view
The Linux HID core allocated a report buffer without zero-initializing it. Because many HID drivers share this buffer, crafted reports could cause disclosure of uninitialized kernel memory. CVSS is 5.5 with local access, low complexity, low privileges, no user interaction, and high confidentiality impact.
Likely exposure
Linux systems running affected kernel versions or downstream vendor builds are in scope. Exposure depends on kernel lineage and backported fixes, so distro and appliance advisories matter more than upstream version strings alone.
Exploitation context
CISA KEV status supports known exploitation. The provided data does not describe public exploit code, targets, or attack procedures. The CVSS vector indicates a local, low-privilege confidentiality issue rather than remote code execution.
Researcher notes
Focus validation on whether the HID core fix is present in the running kernel source or vendor package. Do not rely only on upstream version numbers, because distro kernels commonly backport security patches.
Mitigation direction
- Apply vendor-provided Linux kernel updates or fixed downstream packages.
- Prioritize systems covered by CISA KEV requirements or exposed multi-user workloads.
- Check Debian, Siemens, and other vendor advisories for backported fixes.
- Avoid direct wrangler-style assumptions; validate kernel package provenance before closure.
Validation and detection
- Inventory Linux kernel versions and vendor appliance firmware using affected advisories.
- Confirm installed kernels include the HID report buffer zero-initialization fix.
- Map Debian LTS package updates to deployed Debian systems.
- Review CISA KEV tracking for required remediation deadlines.
- Document exceptions where vendors have not yet issued guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50302 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-50302 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-03-04T00:00:00.000Z: CVE-2024-50302 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26CVE reference, Linux
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5CVE reference, Linux
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46CVE reference, Linux
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aafCVE reference, Linux
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0bCVE reference, Linux
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191CVE reference, Linux
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648CVE reference, Linux
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552CVE reference, Linux
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302CVE reference, CISA-ADP · government-resource
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-355557.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.