CVE-2024-57908

What it actually does

Local kernel buffer array used for triggered IIO data push is not zero-initialized for inactive channels, leaking uninitialized kernel memory contents to userspace.

Why it matters to the business

User-space processes on affected systems may obtain fragments of kernel memory that could contain sensitive internal state, increasing risk of information exposure in environments running the listed packages.

How an attack unfolds

An attacker with local access opens the relevant IIO device, enables a triggered buffer, and reads the buffer contents; because only active channels are written, remaining bytes contain whatever was previously on the stack, allowing leakage of kernel data. Threat actors noted in Linux kernel uninitialized-resource and out-of-bounds campaigns could chain this with other primitives for broader access.

How to fix it

Upgrade the affected java-1.6.0-openjdk packages on Red Hat Enterprise Linux 5 and 6 to the versions listed in the fixed_versions field (for example java-1.6.0-openjdk on RHEL 5 client/server to 1:1.6.0.39-1.13.11.0.el5_11 and on RHEL 6 to 1:1.6.0.39-1.13.11.0.el6_7). Reboot if required by the update.

How to confirm the fix worked

After patching, confirm the installed package versions match the fixed releases, then exercise the IIO triggered buffer path and verify that reads return zeroed bytes for inactive channels.

Typical attack path

1. Obtain local user access on a system running an affected kernel or listed package
2. Locate and open the kmx61 IIO device node
3. Configure and enable a triggered buffer using only a subset of channels
4. Read data from the buffer and inspect bytes belonging to inactive channels for kernel memory contents

How to detect it

Examine kernel audit logs and application logs for processes opening IIO device nodes followed by reads of triggered buffers; look for unexpected non-zero data patterns in sensor reads that could indicate prior uninitialized memory exposure. Correlate with known Linux kernel information-disclosure patterns referenced by the listed threat actors.

What your security team should do

• Prioritize patching systems that expose IIO devices or run the listed OpenJDK packages given the 630 days since publication
• Review local processes that interact with IIO sensors and restrict access via device permissions
• Monitor EPSS trend (stable at ~0.0022) and any new Linux-kernel uninitialized-resource exploitation reporting