Information Leak in Linux Kernel Affects Habanalabs Driver

CVE-2023-50431

Summary

The vulnerability in the Linux kernel's Habanalabs driver allows sensitive information to leak into user space due to the uninitialized padding in the data structure. This occurs specifically in the sec_attest_info function within the habanalabs_ioctl.c file. The failure to initialize info->pad0 may expose system information that could be exploited by malicious users to gain unauthorized access or insights into the kernel's internal operations, thus highlighting the need for proper input validation and initialization in critical system components.

References