CyberRota Analysis
AI-GeneratedThe Linux waitid() function is vulnerable due to improper handling of the siginfo_t struct, allowing unprivileged users to access 104 bytes of uninitialized kernel stack data that may leak sensitive information. This vulnerability poses a risk to systems where untrusted users have access, particularly in multi-user environments. System administrators and security teams should prioritize addressing this issue to mitigate potential data exposure.
Original NVD Description
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.
Related CVEs
Other vulnerabilities affecting the same vendor(s)