Linux Kernel ITG3200 Gyroscope Driver I2C Read Stack Mismanagement Vulnerability

A vulnerability exists in the ITG3200 gyroscope driver of the Linux kernel, specifically within the I2C reading function. The issue arises because the function 'itg3200_read_all_channels' incorrectly handles the buffer parameter, leading to a functional bug and an information leak. Instead of writing data into the caller's scan buffer, the I2C transfer overwrites a local stack slot, which is then discarded when the function returns. This mistake causes uninitialized data to be sent to userspace via the IIO device interface, while the actual sensor data is not delivered. The problem does not affect the non-buffered data reading method, which operates correctly.

Impact

This vulnerability causes a functional error by failing to provide the correct gyroscope and temperature data through the IIO buffer, and it also creates an information leak by exposing uninitialized stack data to userspace.

Reproduction

The vulnerability can be reproduced by triggering a scan with the ITG3200 gyroscope driver. The I2C read function will incorrectly transfer data into a local stack variable instead of the intended buffer, causing the IIO subsystem to send uninitialized data to userspace.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. The specific commit addressing this issue is available in the Linux kernel stable tree.