Linux Kernel ST LSM6DSX Driver Stack Leak Vulnerability in Tagged FIFO Buffer

A stack leak vulnerability has been identified in the Linux kernel's ST LSM6DSX IMU driver, specifically in the tagged FIFO buffer handling. The issue arises because the FIFO path declares a buffer on the stack with an alignment requirement but without an initializer. This oversight creates a gap in the data structure, leading to an unintentional leak of uninitialized data to userspace. When the driver copies a specified number of bytes (6 bytes) from the buffer, the uninitialized space between the data and the timestamp is exposed, potentially allowing for information leakage.

Impact

Exploitation of this vulnerability could result in a stack leak, where uninitialized data is inadvertently exposed to userspace, potentially leading to information disclosure.

Reproduction

The vulnerability can be reproduced by using the ST LSM6DSX IMU driver with the tagged FIFO buffer feature enabled. The driver will copy data from the FIFO buffer to userspace, including the uninitialized bytes that create the leak.

Remediation

The vulnerability has been addressed by modifying the driver to zero-initialize the buffer on the stack before it is used. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this issue.