Linux Kernel BMP280 Pressure Sensor Driver Stack Leak Vulnerability

A stack leak vulnerability has been identified in the Linux kernel's BMP280 pressure sensor driver, specifically in the BMP580 trigger handler. The issue arises because the handler declares a scan buffer on the stack without initializing it, and then copies 24-bit sensor data into 4-byte little-endian fields. This process leaves the high byte of the compensated temperature and pressure values uninitialized. As a result, two bytes of stack data are inadvertently exposed to userspace with each scan. This vulnerability is a regression from a previous version where the buffer was managed in private data, allowing for automatic zeroing. Although the BME280 handler was updated to address a similar issue, the BMP580 driver was overlooked because it lacked a padding hole, presenting instead a short-fill problem.

Impact

Exploitation of this vulnerability leads to uninitialized stack data being sent to userspace, potentially allowing for information disclosure.

Reproduction

The vulnerability can be reproduced by using the BMP580 trigger handler in the BMP280 pressure sensor driver. The handler will send uninitialized data from the stack to userspace, demonstrating the stack leak.

Remediation

The vulnerability has been fixed by modifying the BMP580 trigger handler to zero-initialize the scan buffer before use. Users can apply the latest patch available in the Linux kernel stable tree to address this issue.