What’s Vulnerable › Vulnerabilities

CVE-2024-57911: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-19 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.

Affected products

• Linux kernel: from 4.5 before 5.4.290; from 5.5 before 5.10.234; from 5.11 before 5.15.177; from 5.16 before 6.1.125; from 6.2 before 6.6.72; from 6.7 before 6.12.10 — fixed in 5.10.234, 5.15.177, 5.4.290, 6.1.125, 6.12.10, 6.6.72

How to fix

Upgrade to a fixed version: Linux kernel 5.10.234, 5.15.177, 5.4.290, 6.1.125. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/006073761888a632c5d6f93e47c41760fa627f77
• https://git.kernel.org/stable/c/03fa47621bf8fcbf5994c5716021527853f9af3d
• https://git.kernel.org/stable/c/333be433ee908a53f283beb95585dfc14c8ffb46
• https://git.kernel.org/stable/c/74058395b2c63c8a438cf199d09094b640f8c7f4
• https://git.kernel.org/stable/c/b0642d9c871aea1f28eb02cd84d60434df594f67
• https://git.kernel.org/stable/c/e1c1e8c05010103c9c9ea3e9c4304b0b7e2c8e4a
• https://git.kernel.org/stable/c/ea703cda36da0dacb9a2fd876370003197d8a019
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Get alerted when CVE-2024-57911 or the next vulnerability affects your stack