CVE-2024-57910

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description The issue concerns an information leak in the triggered buffer of the Linux kernel's iio: light: vcnl4035 driver. The 'buffer' local array is used to push data to userspace from a triggered buffer but does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. This leaves at least 4 bytes uninitialized even after writing an integer value with regmap read(). Initializing the array to zero before using it avoids pushing uninitialized information to userspace.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider initializing the 'buffer' local array to zero before using it to avoid pushing uninitialized information to userspace. Restrict access to the vulnerable iio: light: vcnl4035 driver until the update is applied.