CVE-2024-57911

iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

State: Published
Severity: 7.1 High
Published: Jan 19, 2025
Updated: May 11, 2026
Reserved: Jan 19, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.

Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
LinuxLinux	415f792447572ef1949a3cef5119bbce8cc66373 to before 03fa47621bf8fcbf5994c5716021527853f9af3dAffected 415f792447572ef1949a3cef5119bbce8cc66373 to before e1c1e8c05010103c9c9ea3e9c4304b0b7e2c8e4aAffected 415f792447572ef1949a3cef5119bbce8cc66373 to before 006073761888a632c5d6f93e47c41760fa627f77Affected 415f792447572ef1949a3cef5119bbce8cc66373 to before b0642d9c871aea1f28eb02cd84d60434df594f67Affected 415f792447572ef1949a3cef5119bbce8cc66373 to before 74058395b2c63c8a438cf199d09094b640f8c7f4Affected 415f792447572ef1949a3cef5119bbce8cc66373 to before ea703cda36da0dacb9a2fd876370003197d8a019Affected 415f792447572ef1949a3cef5119bbce8cc66373 to before 333be433ee908a53f283beb95585dfc14c8ffb46Affected
LinuxLinux	4.5Affected before 4.5Not affected 5.4.290 through 5.4.Not affected 5.10.234 through 5.10.Not affected 5.15.177 through 5.15.Not affected 6.1.125 through 6.1.Not affected 6.6.72 through 6.6.Not affected 6.12.10 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

415f792447572ef1949a3cef5119bbce8cc66373 to before 03fa47621bf8fcbf5994c5716021527853f9af3dAffected
415f792447572ef1949a3cef5119bbce8cc66373 to before e1c1e8c05010103c9c9ea3e9c4304b0b7e2c8e4aAffected
415f792447572ef1949a3cef5119bbce8cc66373 to before 006073761888a632c5d6f93e47c41760fa627f77Affected
415f792447572ef1949a3cef5119bbce8cc66373 to before b0642d9c871aea1f28eb02cd84d60434df594f67Affected
415f792447572ef1949a3cef5119bbce8cc66373 to before 74058395b2c63c8a438cf199d09094b640f8c7f4Affected
415f792447572ef1949a3cef5119bbce8cc66373 to before ea703cda36da0dacb9a2fd876370003197d8a019Affected
415f792447572ef1949a3cef5119bbce8cc66373 to before 333be433ee908a53f283beb95585dfc14c8ffb46Affected

LinuxLinux

4.5Affected
before 4.5Not affected
5.4.290 through 5.4.*Not affected
5.10.234 through 5.10.*Not affected
5.15.177 through 5.15.*Not affected
6.1.125 through 6.1.*Not affected
6.6.72 through 6.6.*Not affected
6.12.10 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.