CVE-2024-57905

What it actually does

Uninitialized padding bytes between the sample value and timestamp fields in a local struct are copied to userspace when a triggered buffer push occurs in the ti-ads1119 ADC driver.

Why it matters to the business

Applications or users with access to the ADC device can receive fragments of uninitialized kernel memory, creating a potential information disclosure vector on affected systems.

How an attack unfolds

An attacker with local access opens the ADC device, configures a triggered buffer, and repeatedly reads samples; each read returns a struct whose padding area contains whatever data previously occupied that memory location.

How to fix it

Update to a kernel containing commit 2f1687cca911a2f294313c762e0646cd9e7be8cc or apply the equivalent vendor patch that zeros the scan struct before buffer submission.

How to confirm the fix worked

Confirm the driver source initializes the scan struct with memset or equivalent before iio_push_to_buffers; recompile and test that buffer reads no longer contain residual stack data.

Typical attack path

1. Obtain local access on a system exposing the ti-ads1119 device
2. Open the IIO device and enable triggered buffered mode
3. Perform repeated read operations on the buffer
4. Inspect returned samples for residual kernel data in the padding region

How to detect it

Review kernel source or running driver for the uninitialized struct pattern; on patched systems, buffer contents will be zeroed in the padding area.

What your security team should do

• Prioritize kernel updates on any system exposing the ti-ads1119 driver
• Restrict unprivileged access to IIO character devices until patched
• Monitor for future information-leak fixes in IIO ADC drivers