CVE-2024-57911

Katalog CVE

CVSS 7.1 · High EPSS 0,26%

Kerentanan Use of Uninitialized Resource pada linux kernel. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.

Rincian

Terbit di NVD

19 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-908: Use of Uninitialized Resource

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/006073761888a632c5d6f93e47c41760fa627f77 patch
• https://git.kernel.org/stable/c/03fa47621bf8fcbf5994c5716021527853f9af3d patch
• https://git.kernel.org/stable/c/333be433ee908a53f283beb95585dfc14c8ffb46 patch
• https://git.kernel.org/stable/c/74058395b2c63c8a438cf199d09094b640f8c7f4 patch
• https://git.kernel.org/stable/c/b0642d9c871aea1f28eb02cd84d60434df594f67 patch
• https://git.kernel.org/stable/c/e1c1e8c05010103c9c9ea3e9c4304b0b7e2c8e4a patch
• https://git.kernel.org/stable/c/ea703cda36da0dacb9a2fd876370003197d8a019 patch
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html