CVE-2024-57909

What it actually does

The scan struct in the bh1745 IIO driver is not zero-initialized before iio_for_each_active_channel() populates only active channels and the buffer is pushed to userspace, leaking uninitialized kernel stack memory containing inactive channel values.

Why it matters to the business

Unprivileged local processes can obtain fragments of kernel memory that may contain sensitive data such as credentials or addresses, increasing the risk of privilege escalation or information theft on systems running the affected sensor driver.

How an attack unfolds

An attacker with access to the IIO triggered buffer interface opens the device, configures a trigger, enables selected channels, and repeatedly reads samples; each read returns a partially uninitialized struct whose inactive fields contain whatever data previously occupied that stack location.

How to fix it

Upgrade affected packages to the listed fixed versions (libcacard, libcacard-devel, libcacard-tools, qemu-img, qemu-kvm, qemu-kvm-common, qemu-kvm-debuginfo, qemu-kvm-tools at 10:1.5.3-105.el7_2.4 or newer on all listed RHEL 7 variants) and reboot or reload the driver.

How to confirm the fix worked

Confirm the running kernel or package versions match or exceed the fixed releases, then verify that buffer reads from the sensor return zeroed values for disabled channels.

Typical attack path

1. Identify presence of bh1745 or similar IIO light sensor and load the driver
2. Obtain read access to /dev/iio:deviceX or equivalent sysfs trigger interface
3. Set up a triggered buffer and select a subset of channels
4. Repeatedly read from the buffer to harvest uninitialized memory contents
5. Parse leaked data for useful kernel pointers, credentials, or other artifacts

How to detect it

Review kernel audit logs and IIO device access records for repeated reads of light-sensor buffers by non-root processes; examine memory dumps or strace output showing non-zero values in disabled channels.

What your security team should do

• Apply the vendor-supplied package updates immediately on all RHEL 7 systems using the affected QEMU or libcacard components
• Restrict unprivileged access to IIO character devices and sysfs entries until patches are deployed
• Monitor for any local information-leak attempts via auditd or eBPF on IIO read paths