7.1

CVE-2024-57905

iio: adc: ti-ads1119: fix information leak in triggered buffer

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ti-ads1119: fix information leak in triggered buffer

The 'scan' local struct is used to push data to user space from a
triggered buffer, but it has a hole between the sample (unsigned int)
and the timestamp. This hole is never initialized.

Initialize the struct to zero before using it to avoid pushing
uninitialized information to userspace.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.11 < 6.12.10
Linux ≫ Linux Kernel Version 6.13 Update rc1
Linux ≫ Linux Kernel Version 6.13 Update rc2
Linux ≫ Linux Kernel Version 6.13 Update rc3
Linux ≫ Linux Kernel Version 6.13 Update rc4
Linux ≫ Linux Kernel Version 6.13 Update rc5
Linux ≫ Linux Kernel Version 6.13 Update rc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.093
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CISA-ADP 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://git.kernel.org/stable/c/2f1687cca911a2f294313c762e0646cd9e7be8cc
Patch
https://git.kernel.org/stable/c/75f339d3ecd38cb1ce05357d647189d4a7f7ed08
Patch