CVE-2024-50302

What is the Linux Kernel HID Subsystem?

The Linux kernel's Human Interface Device (HID) subsystem manages USB and Bluetooth input devices — keyboards, mice, gamepads, and specialized hardware. When a device connects, the kernel parses its HID report descriptor and allocates buffers to receive device reports. The HID subsystem processes these reports in kernel space with driver-level privilege. On Android devices, the HID subsystem is accessible from USB connections, meaning a malicious USB device (or a device controlled by software) can send crafted HID reports to probe kernel behavior.

Overview

CVE-2024-50302 is a use of uninitialized resource vulnerability in the Linux kernel HID subsystem that allows a local attacker with low privileges to leak kernel memory contents via a specially crafted HID report. On Android devices, this is exploitable through a malicious USB device or from privileged app code. Google TAG confirmed exploitation in the context of forensic access tools used to extract data from locked Android devices. The vulnerability was included in the March 2025 Android Security Bulletin and added to CISA KEV on March 4, 2025.

Affected Versions

Android OEM devices receive patches on varying schedules; check device security patch level.

Technical Details

CWE-908 (Use of Uninitialized Resource). The HID report processing code in the Linux kernel allocates memory buffers to hold report data. A flaw in the initialization sequence causes a buffer or data structure to be returned to a caller or included in a response before it has been fully initialized. The uninitialized memory region retains whatever content was previously stored at that kernel heap location — potentially including kernel pointers, security-sensitive data, or other process memory.

By sending a specially crafted HID report to trigger this code path, an attacker can read the contents of the uninitialized buffer — leaking kernel addresses that defeat KASLR (Kernel Address Space Layout Randomization) or other sensitive kernel data. In a multi-stage exploit chain, this information disclosure is the prerequisite step that allows a subsequent memory corruption exploit (such as CVE-2024-53197 or CVE-2024-53150, both in the USB audio subsystem) to precisely target kernel structures, bypassing ASLR protections.

Discovery

Identified by Linux kernel security maintainers; attributed to active exploitation by Google TAG in the context of forensic access tools targeting Android devices. The March 2025 CISA KEV addition confirmed that this kernel information disclosure was being used in targeted device forensics — likely chained with kernel write primitives to achieve full device unlocking.

Exploitation Context

Linux kernel information disclosure vulnerabilities in the HID or USB subsystem are particularly relevant to mobile forensics: law enforcement and intelligence agencies use specialized forensic hardware (Cellebrite UFED, GrayKey, etc.) that connects to Android devices via USB and exploits kernel vulnerabilities to extract locked device contents. CVE-2024-50302's kernel memory leak assists these tools in defeating ASLR and precisely targeting kernel data structures with subsequent write exploits. The "limited, targeted exploitation" context means these vulnerabilities are used against specific individuals' devices, not broad populations.

Remediation

1. Apply the March 2025 Android security update on all managed Android devices — verify via Settings → Security → Security update, patch level 2025-03-01 or later.
2. Google Pixel devices additionally receive Pixel-specific patches; apply the March 2025 Pixel Security Bulletin.
3. Android OEM devices receive patches on varying schedules — contact the OEM or check their security bulletin.
4. Disable USB debugging on all devices not actively in development use — USB-based attacks require physical USB connection.
5. Enable USB restricted mode where available (Android settings vary by OEM) to block USB data connections when the device is locked.
6. For devices that cannot receive the March 2025 patch (EOL Android versions), consider replacing devices used in security-sensitive roles.