Security readout for executives and security teams
Plain-English summary
CVE-2024-57912 is a Linux kernel bug in the zpa2326 pressure sensor driver. It can leak uninitialized kernel memory to a local user through an Industrial I/O triggered buffer. The CVSS rating is high, but the provided sources do not show active exploitation.
Executive priority
Treat as a high-priority kernel maintenance item for Linux fleets with local multi-user access, containers, or hardware using this sensor driver. Prioritize patching where affected kernels and the zpa2326 driver are present; otherwise validate exposure before escalating emergency response.
Technical view
The zpa2326 driver pushes a local sample struct to userspace with an uninitialized padding gap between temperature and timestamp fields. The fix zero-initializes the struct before use. The CVE maps this to CWE-908 and CVSS 3.1 score 7.1 with local, low-privilege attack requirements.
Likely exposure
Exposure is most likely on Linux systems that include the affected zpa2326 IIO pressure driver and allow local users or workloads to access the relevant triggered buffer interface. Systems without this driver, sensor path, or local user access appear less exposed based on the provided evidence.
Exploitation context
The source bundle does not list CISA KEV status and provides no cited evidence of active exploitation. Abuse requires local access and depends on the affected driver path being present and reachable. The impact is primarily confidentiality, with availability impact also reflected in the CVSS vector.
Researcher notes
The root cause is uninitialized struct padding copied to userspace from the triggered buffer path. The provided fix direction is defensive initialization, not an interface redesign. Evidence is sufficient for vulnerability mechanics and patch direction, but incomplete for real-world exploitation prevalence.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Review Debian LTS advisories if running affected Debian LTS kernels.
- Check vendor kernel guidance for backported fixed package versions.
- Limit local access to IIO device interfaces where operationally feasible.
Validation and detection
- Inventory Linux kernel versions against the CVE affected and fixed version data.
- Confirm whether the zpa2326 IIO pressure driver is built, loaded, or available.
- Check distribution advisories for patched kernel package status.
- Review local permissions for IIO triggered buffer device access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57912 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9629ff1a86823269b12fb1ba9ca4efa945906287CVE reference, Linux
- https://git.kernel.org/stable/c/d25f1fc273670271412a52a1efbdaf5dcf274ed8CVE reference, Linux
- https://git.kernel.org/stable/c/64a989aa7475b8e76e69b9ec86819ea293e53babCVE reference, Linux
- https://git.kernel.org/stable/c/b7849f62e61242e0e02c776e1109eb81e59c567cCVE reference, Linux
- https://git.kernel.org/stable/c/fefb88a4da961a0b9c2473cbdcfce1a942fcfa9aCVE reference, Linux
- https://git.kernel.org/stable/c/979a0db76ceda8fe1f2f85a116bfe97620ebbadfCVE reference, Linux
- https://git.kernel.org/stable/c/6007d10c5262f6f71479627c1216899ea7f09073CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.