NetSight
IP …
high7.1

CVE-2024-57911

In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' ar…

Impact

In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.5 before 5.4.290
from 5.5 before 5.10.234
from 5.11 before 5.15.177
from 5.16 before 6.1.125
from 6.2 before 6.6.72
from 6.7 before 6.12.10

Weakness classification

CWE-908

References