Problem Description:
To retrieve the previous timer value, the kernel calls
realtimer_gettime(), which obtains the current time for the timer's
clock. For a timer using CLOCK_TAI this can fail when no TAI offset
has been configured, but the error return was not checked, so the
uninitialized output buffer was copied to userspace.
Impact:
An unprivileged local user can obtain uninitialized kernel stack
memory by creating a POSIX timer with CLOCK_TAI and calling
timer_settime(2), potentially disclosing sensitive kernel data.