CVE-2024-57907

Summary

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: rockchip_saradc: fix information leak in triggered buffer

The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.

Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 85a9c98a5e0f22d911b00077d751e34fff1401aaaffected
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 7a07fb80ea886e9134284a27d0155cca7649e293affected
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 64b79afdca7b27a768c7d3716b7f4deb1d6b955caffected
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 5a95fbbecec7a34bbad5dcc3156700b8711d53c4affected
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 8193941bc4fe7247ff13233f328aea709f574554affected
LinuxLinux4e130dc7b41348b13684f0758c26cc6cf72a3449 < 38724591364e1e3b278b4053f102b49ea06ee17caffected
LinuxLinux5.9affected
LinuxLinux0 < 5.9unaffected
LinuxLinux5.10.234 <= 5.10.*unaffected
LinuxLinux5.15.177 <= 5.15.*unaffected
LinuxLinux6.1.127 <= 6.1.*unaffected
LinuxLinux6.6.72 <= 6.6.*unaffected
LinuxLinux6.12.10 <= 6.12.*unaffected
LinuxLinux6.13 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References