Out-of-Bounds Access Vulnerability in Linux Kernel - linux Package
Summary
DEBIAN-CVE-2024-43825: In the Linux kernel, the following vulnerability has been resolved: iio: Fix the sorting functionality in iio_gts_build_avail_time_table The sorting in iio_gts_build_avail_time_table is not working as intended. Affects linux versions < 6.10.3-1. Fixed in 6.10.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages hardware resources and system processes. It is crucial for system stability and performance. The kernel is responsible for handling system calls, managing memory, and facilitating communication between hardware and software. This vulnerability affects versions of the linux package in Debian 13 and 14, specifically related to the input/output (I/O) subsystem.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the iio_gts_build_avail_time_table function, where the sorting functionality fails under certain conditions. When the time value is zero in the gts->itime_table[i].time_us array, it can lead to an infinite loop and out-of-bounds writes, potentially causing system crashes or unpredictable behavior. This issue arises from improper handling of the sorting logic, which does not account for zero values, leading to a failure in terminating the loop correctly.
How To Fix
Minimum fixed version
6.10.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel's sorting functionality poses a significant risk of out-of-bounds access, which can lead to system crashes. It is essential for users of the linux package in Debian 13 and 14 to update to the patched version 6.10.3-1 to ensure system security and stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the Linux kernel's sorting functionality, which can lead to system instability.
The vulnerability affects the linux package in Debian 13 and 14 prior to version 6.10.3-1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential risks.
More details can be found in the official Debian CVE database or by checking the Linux kernel mailing list for discussions regarding this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
