CVE-2024-57909
published 2025-01-19CVE-2024-57909: In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is…
PriorityP428high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.23%
14.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1745: fix information leak in triggered buffer
The 'scan' local struct is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the struct to zero before using it to avoid pushing
uninitialized information to userspace.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.10-1 (forky) | linux 6.12.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= eab35358aae705b779a7c8b405474d1290175196 < 1cca2a666e099aa018e5ab385f0a6e01a3053629 | 1cca2a666e099aa018e5ab385f0a6e01a3053629 |
| linux | linux | >= eab35358aae705b779a7c8b405474d1290175196 < b62fbe3b8eedd3cf3c9ad0b7cb9f72c3f40815f0 | b62fbe3b8eedd3cf3c9ad0b7cb9f72c3f40815f0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.12.10-1 | 6.12.10-1 |
| linux | linux_kernel | >= 0 < 6.12.10-1 | 6.12.10-1 |
| linux | linux_kernel | >= 6.12 < 6.12.10 | 6.12.10 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1LOW
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-57909: In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local stru
osv·2025-01-19·CVSS 7.1
CVE-2024-57909 [HIGH] CVE-2024-57909: In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local stru
In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.
GHSA
GHSA-52cr-8q5h-6fpf: In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1745: fix information leak in triggered buffer
The 'scan' local st
ghsa_unreviewed·2025-01-19
CVE-2024-57909 [HIGH] CWE-908 GHSA-52cr-8q5h-6fpf: In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1745: fix information leak in triggered buffer
The 'scan' local st
In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1745: fix information leak in triggered buffer
The 'scan' local struct is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the struct to zero before using it to avoid pushing
uninitialized information to userspace.
Red Hat
kernel: iio: light: bh1745: fix information leak in triggered buffer
vendor_redhat·2025-01-19·CVSS 7.1
CVE-2024-57909 [HIGH] CWE-908 kernel: iio: light: bh1745: fix information leak in triggered buffer
kernel: iio: light: bh1745: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1745: fix information leak in triggered buffer
The 'scan' local struct is used to push data to user space from a
triggered buffer, but it does not set values for inactive channels, as
it only uses iio_for_each_active_channel() to assign new values.
Initialize the struct to zero before using it to avoid pushing
uninitialized information to userspace.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) -
Debian
CVE-2024-57909: linux - In the Linux kernel, the following vulnerability has been resolved: iio: light:...
vendor_debian·2024·CVSS 7.1
CVE-2024-57909 [HIGH] CVE-2024-57909: linux - In the Linux kernel, the following vulnerability has been resolved: iio: light:...
In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.12.10-1)
sid: resolved (fixed in 6.12.10-1)
trixie: resolved (fixed in 6.12.10-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-19
Published