7.1

CVE-2024-57910

In the Linux kernel, the following vulnerability has been resolved:

iio: light: vcnl4035: fix information leak in triggered buffer

The 'buffer' local array is used to push data to userspace from a
triggered buffer, but it does not set an initial value for the single
data element, which is an u16 aligned to 8 bytes. That leaves at least
4 bytes uninitialized even after writing an integer value with
regmap_read().

Initialize the array to zero before using it to avoid pushing
uninitialized information to userspace.
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.4.132 < 5.4.290
Linux ≫ Linux Kernel Version >= 5.10.50 < 5.10.234
Linux ≫ Linux Kernel Version >= 5.12.17 < 5.13
Linux ≫ Linux Kernel Version >= 5.13.2 < 5.15.177
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.125
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.72
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.10
Linux ≫ Linux Kernel Version6.13 Updaterc1
Linux ≫ Linux Kernel Version6.13 Updaterc2
Linux ≫ Linux Kernel Version6.13 Updaterc3
Linux ≫ Linux Kernel Version6.13 Updaterc4
Linux ≫ Linux Kernel Version6.13 Updaterc5
Linux ≫ Linux Kernel Version6.13 Updaterc6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.159
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.