NVD Vulnerability Detail

CVE-2024-50302

Summary	In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
Publication Date	Nov. 19, 2024, 11:16 a.m.
Registration Date	Nov. 19, 2024, 4 p.m.
Last Update	March 8, 2025, 7:07 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:google:android:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf	Patch
2	https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552	Patch
3	https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b	Patch
4	https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5	Patch
5	https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648	Patch
6	https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191	Patch
7	https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46	Patch
8	https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-908	初期化されていないリソースの使用	https://cwe.mitre.org/data/definitions/908.html

JVN Vulnerability Information

Linux の Linux Kernel における初期化されていないリソースの使用に関する脆弱性

Title	Linux の Linux Kernel における初期化されていないリソースの使用に関する脆弱性
Summary	Linux の Linux Kernel には、初期化されていないリソースの使用に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 29, 2024, midnight
Registration Date	Nov. 28, 2024, 6:17 p.m.
Last Update	Aug. 21, 2025, 2:35 p.m.

Affected System

Linux

Linux Kernel 3.12 以上 4.19.324 未満

Linux Kernel 4.20 以上 5.4.286 未満

Linux Kernel 5.11 以上 5.15.172 未満

Linux Kernel 5.16 以上 6.1.117 未満

Linux Kernel 5.5 以上 5.10.230 未満

Linux Kernel 6.12

Linux Kernel 6.2 以上 6.6.61 未満

Linux Kernel 6.7 以上 6.11.8 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-50302	https://www.cve.org/CVERecord?id=CVE-2024-50302
National Vulnerability Database (NVD)
2	CVE-2024-50302	https://nvd.nist.gov/vuln/detail/CVE-2024-50302

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-908	http://cwe.mitre.org/data/definitions/908.html

ベンダー情報

No	Name	URL
Kernel.org git repositories
1	HID: core: zero-initialize the report buffer (05ade5d)	https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
2	HID: core: zero-initialize the report buffer (177f25d)	https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552
3	HID: core: zero-initialize the report buffer (1884ab3)	https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
4	HID: core: zero-initialize the report buffer (3f9e88f)	https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
5	HID: core: zero-initialize the report buffer (492015e)	https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
6	HID: core: zero-initialize the report buffer (9d9f5c7)	https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
7	HID: core: zero-initialize the report buffer (d7dc68d)	https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
8	HID: core: zero-initialize the report buffer (e7ea601)	https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
Linux Kernel
9	Linux Kernel Archives	https://www.kernel.org

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-25-226-07	https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07
JVN
2	JVNVU#92169998	https://jvn.jp/vu/JVNVU92169998/index.html

Change Log

No	Changed Details	Date of change
1	[2024年11月28日] 掲載	Nov. 28, 2024, 10:28 a.m.
2	[2025年08月21日] 参考情報：JVN (JVNVU#92169998) を追加参考情報：ICS-CERT ADVISORY (ICSA-25-226-07) を追加	Aug. 21, 2025, 2:34 p.m.