CVE-2024-43825

What it actually does

Out-of-bounds writes occur in iio_gts_build_avail_time_table when gts->itime_table contains a zero time_us value, because the inner loop fails to terminate after insertion and continues incrementing idx indefinitely; without zeros the routine copies elements without performing the intended sort and duplicate removal.

Why it matters to the business

Memory corruption in the IIO subsystem can crash systems or enable local privilege escalation; with 83 downstream dependents the flaw affects a wide range of embedded and sensor-driven deployments that must be updated before the published remediation deadline.

How an attack unfolds

An attacker supplies a crafted time sequence containing a zero value to the IIO generic time-sort helper; the faulty insertion loop then performs repeated out-of-bounds writes, corrupting adjacent kernel structures and potentially allowing code execution.

How to fix it

Upgrade pycryptodome and pycryptodomex to version 3.19.1 or later; apply the upstream kernel patch that corrects the sorting loop termination and duplicate-removal logic; rebuild and reboot any affected systems.

How to confirm the fix worked

Confirm the installed package reports version 3.19.1 or newer; run kernel self-tests that exercise iio_gts_build_avail_time_table with both zero-containing and duplicate-free time tables; verify that the resulting available-time arrays are correctly sorted and bounded.

Typical attack path

1. Locate a process or driver that invokes iio_gts_build_avail_time_table
2. Prepare an itime_table array whose time_us entries include a zero (e.g., 3,0,1)
3. Trigger the function via the normal IIO device initialization path
4. Observe unbounded writes that corrupt kernel memory
5. Leverage the resulting corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for IIO-related oops or page-fault messages that reference iio_gts_build_avail_time_table; inspect process creation of IIO device nodes immediately preceding any crash; search audit logs for unusual calls that pass zero-valued timing parameters.

What your security team should do

• Immediately inventory all systems using pycryptodome/pycryptodomex or the affected IIO code path
• Prioritize patching to the listed fixed versions before any external exposure
• Add kernel memory-corruption monitoring for the IIO subsystem until patches are deployed
• Re-test sensor drivers after upgrade to ensure time-table sorting behaves as documented