CVE-2024-57908

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57908
In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0871eb8d700b33dd7fa86c80630d62ddaef58c2c Patch
https://git.kernel.org/stable/c/565814cbbaa674d2901428796801de49a611e59d Patch
https://git.kernel.org/stable/c/6985ba4467e4b15b809043fa7740d1fb23a1897b Patch
https://git.kernel.org/stable/c/6ae053113f6a226a2303caa4936a4c37f3bfff7b Patch
https://git.kernel.org/stable/c/a07f698084412a3ef5e950fcac1d6b0f53289efd Patch
https://git.kernel.org/stable/c/a386d9d2dc6635f2ec210b8199cfb3acf4d31305 Patch
https://git.kernel.org/stable/c/cde312e257b59ecaa0fad3af9ec7e2370bb24639 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
History

18 Feb 2025, 13:39

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
CWE CWE-908
References () https://git.kernel.org/stable/c/0871eb8d700b33dd7fa86c80630d62ddaef58c2c - () https://git.kernel.org/stable/c/0871eb8d700b33dd7fa86c80630d62ddaef58c2c - Patch
References () https://git.kernel.org/stable/c/565814cbbaa674d2901428796801de49a611e59d - () https://git.kernel.org/stable/c/565814cbbaa674d2901428796801de49a611e59d - Patch
References () https://git.kernel.org/stable/c/6985ba4467e4b15b809043fa7740d1fb23a1897b - () https://git.kernel.org/stable/c/6985ba4467e4b15b809043fa7740d1fb23a1897b - Patch
References () https://git.kernel.org/stable/c/6ae053113f6a226a2303caa4936a4c37f3bfff7b - () https://git.kernel.org/stable/c/6ae053113f6a226a2303caa4936a4c37f3bfff7b - Patch
References () https://git.kernel.org/stable/c/a07f698084412a3ef5e950fcac1d6b0f53289efd - () https://git.kernel.org/stable/c/a07f698084412a3ef5e950fcac1d6b0f53289efd - Patch
References () https://git.kernel.org/stable/c/a386d9d2dc6635f2ec210b8199cfb3acf4d31305 - () https://git.kernel.org/stable/c/a386d9d2dc6635f2ec210b8199cfb3acf4d31305 - Patch
References () https://git.kernel.org/stable/c/cde312e257b59ecaa0fad3af9ec7e2370bb24639 - () https://git.kernel.org/stable/c/cde312e257b59ecaa0fad3af9ec7e2370bb24639 - Patch
First Time Linux linux Kernel
Linux

02 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0871eb8d700b33dd7fa86c80630d62ddaef58c2c -
  • () https://git.kernel.org/stable/c/a386d9d2dc6635f2ec210b8199cfb3acf4d31305 -

23 Jan 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/a07f698084412a3ef5e950fcac1d6b0f53289efd -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: imu: kmx61: se corrige la fuga de información en el búfer activado La matriz local 'buffer' se utiliza para enviar datos al espacio del usuario desde un búfer activado, pero no establece valores para canales inactivos, ya que solo utiliza iio_for_each_active_channel() para asignar nuevos valores. Inicialice la matriz a cero antes de usarla para evitar enviar información no inicializada al espacio del usuario.

19 Jan 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-19 12:15

Updated : 2025-02-18 13:39

NVD link : CVE-2024-57908

Mitre link : CVE-2024-57908

CVE.ORG link : CVE-2024-57908

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource