CVE-2024-57910 — iio: light: vcnl4035: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push dat…
Published: 2025-01-19 · CVSS: 7.1 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read(). Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7