CVE-2024-57910

Q: What is the severity of CVE-2024-57910?

CVE-2024-57910 has a CVSS score of 7.1 (HIGH). This CVE describes an information leak vulnerability in the Linux kernel's vcnl4035 light sensor driver. When triggered buffer data is sent to userspace, uninitialized memory content (at least 4 bytes) can be exposed due to improper buffer initialization. This affects systems using the vcnl4035 sensor driver in the Linux kernel.

7.1 HIGH

📋 TL;DR

This CVE describes an information leak vulnerability in the Linux kernel's vcnl4035 light sensor driver. When triggered buffer data is sent to userspace, uninitialized memory content (at least 4 bytes) can be exposed due to improper buffer initialization. This affects systems using the vcnl4035 sensor driver in the Linux kernel.

💻 Affected Systems

Products:

Linux kernel with vcnl4035 sensor driver

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only systems with vcnl4035 sensor hardware and the driver loaded are affected. The driver is typically auto-loaded when hardware is detected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sensitive kernel memory contents (including potentially privileged data, cryptographic keys, or other process information) could be leaked to unprivileged userspace applications, enabling further attacks.

🟠

Likely Case

Limited information disclosure of random kernel memory contents to userspace applications with access to the sensor device, potentially revealing system state information.

🟢

If Mitigated

With proper access controls, only authorized users/applications can access the sensor device, limiting exposure of leaked information.

🌐 Internet-Facing: LOW - This requires local access to the sensor device interface and is not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or applications with device access could exploit this to gather system information for privilege escalation or lateral movement.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to read from the sensor device. The information leak is consistent and predictable due to buffer alignment.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (13e56229fc81051a42731046e200493c4a7c28ff and related)

Vendor Advisory: https://git.kernel.org/stable/c/13e56229fc81051a42731046e200493c4a7c28ff

Restart Required: No

Instructions:

1. Update to a patched kernel version from your distribution. 2. For custom kernels: apply the fix commits from kernel.org. 3. Rebuild and install the kernel. 4. No reboot required if using kernel livepatch capabilities.

🔧 Temporary Workarounds

Disable vcnl4035 driver

all

Prevent loading of the vulnerable driver if vcnl4035 hardware is not needed

echo 'blacklist vcnl4035' > /etc/modprobe.d/blacklist-vcnl4035.conf
rmmod vcnl4035

Restrict device access

all

Limit access to the sensor device to trusted users only

chmod 600 /sys/bus/iio/devices/*/in_illuminance_raw
chown root:root /sys/bus/iio/devices/*/in_illuminance_raw

🧯 If You Can't Patch

Implement strict access controls on /sys/bus/iio/devices interfaces
Monitor for unusual access patterns to sensor devices in system logs

🔍 How to Verify

Check if Vulnerable:

Check if vcnl4035 module is loaded: lsmod | grep vcnl4035 AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or is newer than vulnerable versions. Check /sys/bus/iio/devices for vcnl4035 devices.

📡 Detection & Monitoring

Log Indicators:

Unusual access patterns to /sys/bus/iio/devices/*
Multiple failed or successful reads from sensor devices

Network Indicators:

Not applicable - local vulnerability only

SIEM Query:

process.access.path CONTAINS '/sys/bus/iio/devices' AND process.name IN ('cat', 'dd', custom_apps)

📊 Metadata

CVE ID: CVE-2024-57910

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-908

EPSS Score: 0.05% exploit probability (15.8th percentile)

Published: January 19, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable vcnl4035 driver

Restrict device access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities