CVE-2024-57907

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57907
In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/38724591364e1e3b278b4053f102b49ea06ee17c Patch
https://git.kernel.org/stable/c/5a95fbbecec7a34bbad5dcc3156700b8711d53c4 Patch
https://git.kernel.org/stable/c/64b79afdca7b27a768c7d3716b7f4deb1d6b955c Patch
https://git.kernel.org/stable/c/7a07fb80ea886e9134284a27d0155cca7649e293 Patch
https://git.kernel.org/stable/c/8193941bc4fe7247ff13233f328aea709f574554 Patch
https://git.kernel.org/stable/c/85a9c98a5e0f22d911b00077d751e34fff1401aa Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
History

18 Feb 2025, 13:40

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
References () https://git.kernel.org/stable/c/38724591364e1e3b278b4053f102b49ea06ee17c - () https://git.kernel.org/stable/c/38724591364e1e3b278b4053f102b49ea06ee17c - Patch
References () https://git.kernel.org/stable/c/5a95fbbecec7a34bbad5dcc3156700b8711d53c4 - () https://git.kernel.org/stable/c/5a95fbbecec7a34bbad5dcc3156700b8711d53c4 - Patch
References () https://git.kernel.org/stable/c/64b79afdca7b27a768c7d3716b7f4deb1d6b955c - () https://git.kernel.org/stable/c/64b79afdca7b27a768c7d3716b7f4deb1d6b955c - Patch
References () https://git.kernel.org/stable/c/7a07fb80ea886e9134284a27d0155cca7649e293 - () https://git.kernel.org/stable/c/7a07fb80ea886e9134284a27d0155cca7649e293 - Patch
References () https://git.kernel.org/stable/c/8193941bc4fe7247ff13233f328aea709f574554 - () https://git.kernel.org/stable/c/8193941bc4fe7247ff13233f328aea709f574554 - Patch
References () https://git.kernel.org/stable/c/85a9c98a5e0f22d911b00077d751e34fff1401aa - () https://git.kernel.org/stable/c/85a9c98a5e0f22d911b00077d751e34fff1401aa - Patch
First Time Linux linux Kernel
Linux
CWE CWE-908

02 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/85a9c98a5e0f22d911b00077d751e34fff1401aa -

23 Jan 2025, 17:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: adc: rockchip_saradc: corrige pérdida de información en búfer activado La estructura local 'data' se usa para enviar datos al espacio de usuario desde un búfer activado, pero no establece valores para canales inactivos, ya que solo usa iio_for_each_active_channel() para asignar nuevos valores. Inicialice la estructura a cero antes de usarla para evitar enviar información no inicializada al espacio de usuario.
References
  • () https://git.kernel.org/stable/c/64b79afdca7b27a768c7d3716b7f4deb1d6b955c -
  • () https://git.kernel.org/stable/c/7a07fb80ea886e9134284a27d0155cca7649e293 -

19 Jan 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-19 12:15

Updated : 2025-02-18 13:40

NVD link : CVE-2024-57907

Mitre link : CVE-2024-57907

CVE.ORG link : CVE-2024-57907

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource