Information Leak in Linux Kernel's VCNL4035 Light Sensor

CVE-2024-57910

Summary

A vulnerability exists in the Linux kernel's handling of the VCNL4035 light sensor, where a local buffer used for data transfer to userspace is at risk of leaking uninitialized data. Specifically, if the buffer is not properly initialized before use, it may contain remnants of previous data, potentially exposing sensitive information. This issue arises from the failure to set an initial value for the buffer's data elements, resulting in at least 4 bytes of uninitialized data after reading an integer value. To mitigate this vulnerability, it is crucial to zero-initialize the buffer prior to its application in data transfer.

References