Description
In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16550: fix stack leak in trigger handler adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger. Fix this all by just zero-initializing the structure on the stack.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e4570f4bb231f01e32d44fd38841665f340d6914 to < ce582b22dd2ff15ac99101c22ec1559d1febe2ffaffectede4570f4bb231f01e32d44fd38841665f340d6914 to < c2c255444392872cbbf46d640cb3a938e8000309affectede4570f4bb231f01e32d44fd38841665f340d6914 to < 474f8928d50b09f7dcf507049f08732640b88b49affected
Linux Linux
Default version status: affected
6.15affected0 to < 6.15unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected