PT-2025-3634 · Linux+1 · Linux Kernel+1

Javier Carrasco · Published 2024-12-07 · Updated 2025-09-29 · CVE-2024-57909

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns an information leak in the triggered buffer of the Linux kernel's iio light bh1745 component. The local struct 'scan' is used to send data to user space from a triggered buffer but does not initialize values for inactive channels, as it only uses iio for each active channel() to assign new values. This can lead to sending uninitialized information to user space. The struct should be initialized to zero before use to prevent this leak.

Recommendations To resolve the issue, initialize the 'scan' local struct to zero before using it to push data to user space. This ensures that no uninitialized information is sent to userspace. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALSA-2025_16880

ALT-PU-2025-3467

BDU:2025-10567

CVE-2024-57909

Affected Products

Alt Linux

Linux Kernel

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57909.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57909 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20480.html · Vendor Advisory
• https://git.kernel.org/stable/c/1cca2a666e099aa018e5ab385f0a6e01a3053629 · Patch
• https://bdu.fstec.ru/vul/2025-10567 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-57909 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-57909 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20530.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-57909 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-57909 · Security Note
• https://ubuntu.com/security/CVE-2024-57909 · Vendor Advisory
• https://git.kernel.org/stable/c/b62fbe3b8eedd3cf3c9ad0b7cb9f72c3f40815f0 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-57909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57909 · Security Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.10 · Note