CVE-2024-57906 — Use of Uninitialized Resource in Linux
Severity
7.1HIGHNVD
OSV7.8OSV6.2OSV5.5
EPSS
0.0%
top 96.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 19
Latest updateMay 29
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ti-ads8688: fix information leak in triggered buffer
The 'buffer' local array is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing
uninitialized information to userspace.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5linux/linux26aa12ef64ee997d293659bbf645c6df99fb73e5 — 1c80a0985a9a14f33dbf63cd703ca010f094f878+10