NetSight
IP …
high7.1

CVE-2024-57910

In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is …

Impact

In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read(). Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4.132 before 5.4.290
from 5.10.50 before 5.10.234
from 5.12.17 before 5.13
from 5.13.2 before 5.15.177
from 5.16 before 6.1.125
from 6.2 before 6.6.72

Weakness classification

CWE-908

References