CVE-2024-50302

CVE-2024-50302 is a kernel memory information leak vulnerability in the Linux kernel, specifically within the Human Interface Device (HID) core. It affects various Linux-based systems, including Debian and Android, due to improper initialization of the report buffer. This flaw allows a local attacker to potentially disclose sensitive kernel memory via specially crafted reports. Rated with a CVSS score of 5.5 (Medium), this vulnerability has a low attack complexity and requires local access, but can lead to high confidentiality impacts. The EPSS score is low, yet the FAUCET Risk Score is high at 98/100, indicating significant concern. Critically, CVE-2024-50302 is actively exploited in the wild, as confirmed by its inclusion in the KEV catalog and multiple media reports linking it to zero-day exploits used by state-sponsored actors. Despite active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available. The vulnerability has garnered significant community discussion, indicating high awareness among security researchers.