CVE-2024-57907 — Use of Uninitialized Resource in Linux
Severity
7.1HIGHNVD
OSV7.8OSV6.2OSV5.5
EPSS
0.0%
top 97.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 19
Latest updateMay 29
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: rockchip_saradc: fix information leak in triggered buffer
The 'data' local struct is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the struct to zero before using it to avoid pushing
uninitialized information to userspace.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5linux/linux4e130dc7b41348b13684f0758c26cc6cf72a3449 — 85a9c98a5e0f22d911b00077d751e34fff1401aa+6