CVE-2024-57908 — Use of Uninitialized Resource in Linux
Severity
7.1HIGHNVD
OSV7.8OSV6.2OSV5.5
EPSS
0.0%
top 96.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 19
Latest updateMay 29
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: kmx61: fix information leak in triggered buffer
The 'buffer' local array is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing
uninitialized information to userspace.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5linux/linuxc3a23ecc0901f624b681bbfbc4829766c5aa3070 — 0871eb8d700b33dd7fa86c80630d62ddaef58c2c+7