PT-2026-61251 · Linux · Linux
CVE-2026-63934
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: itg3200: fix i2c read into the wrong stack location
itg3200 read all channels() takes
be16 *buf' as a parameter and fills the i2c msg destination as(char *)&buf'. Since buf' is the parameter (a pointer), &buf' is the address of the local pointer
slot on the stack of itg3200 read all channels(), not the address
of the caller's scan buffer. The (char *) cast hides the type
mismatch.i2c transfer() therefore writes ITG3200 SCAN ELEMENTS * sizeof(s16)
= 8 bytes into the parameter's stack slot, which is discarded when
the function returns. The caller's scan buffer in
itg3200 trigger handler() is never written to, so
iio push to buffers with timestamp() pushes uninitialised stack
contents to userspace via /dev/iio:deviceX every scan -- both a
functional bug (no actual gyroscope or temperature data is
delivered through the triggered buffer) and an information leak.
The non-buffered read raw() path is unaffected: it goes through
itg3200 read reg s16() which uses `&out' on a local s16 value,
where that is correct.
Drop the spurious `&' so the i2c read writes into the caller's
buffer.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux