Hayden

A Linux kernel vulnerability has recently caught the attention of security professionals worldwide. CVE-2024-50302 may appear as a medium-severity issue with a CVSS score of 5.5, but it poses significant security risks in real-world scenarios, which is why CISA has urgently added it to their Known Exploited Vulnerabilities (KEV) catalog. This article provides a comprehensive look at the vulnerability and detailed patching instructions.

 

 

1. Understanding CVE-2024-50302: What You Need to Know

CVE-2024-50302 is a use-of-uninitialized-resource vulnerability found in the Linux kernel’s HID (Human Interface Devices) driver. The HID report buffer wasn’t being zero-initialized during allocation, allowing attackers to potentially leak kernel memory through specially crafted reports.

Simply put, when the HID driver allocates memory, previously used data can remain in the buffer before new data overwrites it. This creates a pathway for attackers to access sensitive system information.

Technical Background

This vulnerability was introduced in Linux kernel 3.12 with commit 27ce405039bf and has existed for over a decade. The HID report buffer is a shared resource used by various drivers in different ways, and the lack of proper initialization left previous data vulnerable to disclosure.

 

 

2. Why CISA Added This to the KEV Catalog

On March 4, 2025, CISA added CVE-2024-50302 to their Known Exploited Vulnerabilities catalog. This designation means there’s concrete evidence of active exploitation in real-world attacks, not just theoretical concerns.

Real-World Attack Case: Cellebrite and Serbian Surveillance

The most alarming aspect is that this vulnerability was actively exploited by Cellebrite’s UFED (Universal Forensic Extraction Device) tools to compromise an Android phone belonging to a Serbian student activist.

On December 25, 2024, Serbia’s Security-Information Agency (BIA) detained a 23-year-old student protester and used an exploit chain including this vulnerability to target his Samsung Galaxy A32 device. Amnesty International’s Security Lab discovered and analyzed this incident, revealing how Cellebrite’s surveillance tools exploited this vulnerability to bypass device locks and extract data.

 

 

3. Affected Systems and Versions

CVE-2024-50302 affects a wide range of Linux kernel versions. Here’s the complete impact scope:

Kernel Version Affected Versions Patched Version Patch Commit
4.19.x Before 4.19.324 4.19.324 e7ea60184e1e
5.4.x Before 5.4.286 5.4.286 3f9e88f2672c
5.10.x Before 5.10.230 5.10.230 d7dc68d82ab3
5.15.x Before 5.15.172 5.15.172 05ade5d43378
6.1.x Before 6.1.117 6.1.117 1884ab3d2253
6.6.x Before 6.6.61 6.6.61 9d9f5c75c0c7
6.11.x Before 6.11.8 6.11.8 492015e6249f
6.12.x Before 6.12 6.12 177f25d1292c

Android Device Impact

Google patched this vulnerability in the March 2025 Android Security Bulletin and had already shared patches with OEMs (Original Equipment Manufacturers) in January 2025.

 

 

4. Step-by-Step Patching Guide by Distribution

Ubuntu Systems

Update Ubuntu systems using the following commands:

# Update package lists
sudo apt update

# Upgrade all packages (including kernel)
sudo apt upgrade -y

# Reboot to apply kernel updates
sudo reboot

For Ubuntu Pro users: Ubuntu Pro reduces CVE exposure time from 98 days to 1 day and offers rebootless patching through Livepatch.

# Check Ubuntu Pro status
sudo pro status

# Enable Livepatch for rebootless kernel patching
sudo pro enable livepatch

RHEL/CentOS Systems

For Red Hat-based systems:

# Using YUM package manager (CentOS 7, RHEL 7 and below)
sudo yum update kernel -y

# Using DNF package manager (CentOS 8+, RHEL 8+, Fedora)
sudo dnf update kernel -y

# Reboot system
sudo reboot

Debian Systems

Update Debian using APT:

# Refresh package lists
sudo apt update

# Upgrade kernel packages
sudo apt upgrade linux-image-generic -y

# Reboot
sudo reboot

 

 

5. Patch Verification and Validation

Verify that patches have been applied correctly:

Check Kernel Version

# Check current kernel version
uname -r

# List all installed kernel packages (Ubuntu/Debian)
dpkg -l | grep linux-image

# List installed kernel packages (RHEL/CentOS)
rpm -qa | grep kernel

Review System Logs

# Check kernel messages
dmesg | tail -20

# Check system logs for HID-related messages
journalctl | grep -i hid

 

 

6. Additional Security Hardening

USB Device Access Restrictions

Since this vulnerability can be exploited through USB HID devices, restricting untrusted USB peripheral access is crucial:

# Disable automatic USB device mounting
gsettings set org.gnome.desktop.media-handling automount false

# Install and configure USBGuard (Ubuntu/Debian)
sudo apt install usbguard -y
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable usbguard
sudo systemctl start usbguard

Mobile Device Security Hardening

For Android devices, implement these security measures:

  1. Apply Security Updates Immediately: Settings → System → System Update
  2. Disable Developer Options: Settings → Developer Options → Disable
  3. Turn Off USB Debugging: Developer Options → USB Debugging → Disable
  4. Verify Full Disk Encryption: Settings → Security → Encryption

 

 

CVE-2024-50302 demonstrates that security risks cannot be assessed by numerical scores alone. Despite its CVSS score of 5.5, its exploitation in surveillance tools targeting human rights activists proves its real-world danger extends far beyond simple metrics. Security updates are not optional tasks that can be postponed—they are essential requirements that must be implemented promptly. Organizations and individuals running Linux systems must make regular kernel updates and security patching a standard practice.

 

Related Links:

 

Leave a Reply