CVE-2024-57908

iio: imu: kmx61: fix information leak in triggered buffer

State: Published
Severity: 7.1 High
Published: Jan 19, 2025
Updated: May 11, 2026
Reserved: Jan 19, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: kmx61: fix information leak in triggered buffer

The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.

Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
LinuxLinux	c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 0871eb8d700b33dd7fa86c80630d62ddaef58c2cAffected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before a386d9d2dc6635f2ec210b8199cfb3acf4d31305Affected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before a07f698084412a3ef5e950fcac1d6b0f53289efdAffected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 6985ba4467e4b15b809043fa7740d1fb23a1897bAffected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before cde312e257b59ecaa0fad3af9ec7e2370bb24639Affected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 565814cbbaa674d2901428796801de49a611e59dAffected c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 6ae053113f6a226a2303caa4936a4c37f3bfff7bAffected
LinuxLinux	4.0Affected before 4.0Not affected 5.4.290 through 5.4.Not affected 5.10.234 through 5.10.Not affected 5.15.177 through 5.15.Not affected 6.1.125 through 6.1.Not affected 6.6.72 through 6.6.Not affected 6.12.10 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 0871eb8d700b33dd7fa86c80630d62ddaef58c2cAffected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before a386d9d2dc6635f2ec210b8199cfb3acf4d31305Affected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before a07f698084412a3ef5e950fcac1d6b0f53289efdAffected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 6985ba4467e4b15b809043fa7740d1fb23a1897bAffected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before cde312e257b59ecaa0fad3af9ec7e2370bb24639Affected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 565814cbbaa674d2901428796801de49a611e59dAffected
c3a23ecc0901f624b681bbfbc4829766c5aa3070 to before 6ae053113f6a226a2303caa4936a4c37f3bfff7bAffected

LinuxLinux

4.0Affected
before 4.0Not affected
5.4.290 through 5.4.*Not affected
5.10.234 through 5.10.*Not affected
5.15.177 through 5.15.*Not affected
6.1.125 through 6.1.*Not affected
6.6.72 through 6.6.*Not affected
6.12.10 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.