CVE-2024-57909

Summary

In the Linux kernel, the following vulnerability has been resolved:

iio: light: bh1745: fix information leak in triggered buffer

The 'scan' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.

Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxeab35358aae705b779a7c8b405474d1290175196 < 1cca2a666e099aa018e5ab385f0a6e01a3053629affected
LinuxLinuxeab35358aae705b779a7c8b405474d1290175196 < b62fbe3b8eedd3cf3c9ad0b7cb9f72c3f40815f0affected
LinuxLinux6.12affected
LinuxLinux0 < 6.12unaffected
LinuxLinux6.12.10 <= 6.12.*unaffected
LinuxLinux6.13 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References