Linux and Android: report buffer leak (CVE-2024-50302) #shorts

Summary

Today, we're diving into CVE-2024-50302, a vulnerability recently discovered and affecting the Linux kernel. This issue involves the improper handling of the HID core's report buffer, potentially leading to kernel memory leakage. Notably, Google has highlighted this among its urgent alerts, indicating the exploit's active usage, particularly across Android versions 12 to 15.

Product details

The vulnerability primarily impacts various versions of the Linux kernel, with specific commits identified as vulnerable. Affected versions include those before the fixed updates in branches like 3.12, while newer branches from 4.19 and onward remain unaffected. This flaw is linked to the HID core's handling of zero-initialization of report buffers, which could be manipulated to expose kernel memory.

Vulnerability type summary

This is an implementation vulnerability within the Linux kernel's HID core subsystem. It arises from improper initialization of memory buffers, which can be exploited to reveal sensitive kernel memory via crafted reports. Given its severe implications, the vulnerability has been actively exploited, especially targeting Android environments.

Details of the vulnerability

The vulnerability stems from the HID subsystem's failure to zero-initialize report buffers upon allocation, which are utilized by various drivers. This oversight can lead to kernel memory leakage if maliciously crafted input is processed. SUSE and other security agencies have released advisories, emphasizing the urgency to update affected systems to mitigate potential exploitation.

Conclusion

In conclusion, CVE-2024-50302 represents a critical risk for systems utilizing affected Linux kernel versions, with its impact already observed in active exploits, particularly in Android systems. Organizations relying on these systems should promptly apply security patches and review their exposure to ensure systems are secured against potential exploitation.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
• https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
• https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
• https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
• https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
• https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
• https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
• https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552