CVE-2024-43825 iio: Fix the sorting functionality in iio_gts_build_avail_time_table
A logic error in the Linux kernel IIO driver causes out-of-bounds writes when processing zero time values, potentially allowing code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43825?
CVE-2024-43825 is a high-severity memory corruption vulnerability in Linux kernel, published on 17 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: Fix the sorting functionality in iio_gts_build_avail_time_table
The sorting in iio_gts_build_avail_time_table is not working as intended. It could result in an out-of-bounds access when the time is zero.
Here are more details:
1. When the gts->itime_table[i].time_us is zero, e.g., the time sequence is `3, 0, 1`, the inner for-loop will not terminate and do out-of-bound writes. This is because once `times[j] > new`, the value `new` will be added in the current position and the `times[j]` will be moved to `j+1` position, which makes the if-condition always hold. Meanwhile, idx will be added one, making the loop keep running without termination and out-of-bound write. 2. If none of the gts->itime_table[i].time_us is zero, the elements will just be copied without being sorted as described in the comment "Sort times from all tables to one and remove duplicates".
For more details, please refer to https://lore.kernel.org/all/[email protected].
Weakness: CWE-787
Which versions are affected by CVE-2024-43825?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43825?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-43825 being exploited?
There is no known exploitation of CVE-2024-43825 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-43825, DEBIAN-CVE-2024-43825, GHSA-94rm-mp59-j6h7, UBUNTU-CVE-2024-43825.