Junglewise Threat Intelligence

CVE-2024-38659: Linux Kernel enic out-of-bounds read in enic_set_vf_port

CVE-2024-38659 · Severity: high · CVSS 7.1 · Published 2024-06-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Cisco enic network driver within the Linux kernel could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system processes specific network configuration commands without properly verifying the size of the data provided. This could lead to operational disruptions or unauthorized data exposure on affected Linux systems.

Technical details

An out-of-bounds read vulnerability exists in the Cisco enic driver (drivers/net/ethernet/cisco/enic/enic_main.c) within the Linux kernel. The function enic_set_vf_port assumes that Netlink attributes such as IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID, and IFLA_PORT_HOST_UUID meet specific length requirements (PORT_PROFILE_MAX or PORT_UUID_MAX). However, the underlying rtnetlink policy only enforces maximum size constraints rather than exact matches. An attacker with local privileges can provide shorter-than-expected attributes, causing memcpy operations to read past the intended buffer. This can result in a kernel oops/denial of service or information disclosure. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.35 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4

Timeline

  • 2024-05-22: disclosed: Vulnerability reported by Roded Zats
  • 2024-06-16: patched: Fixes committed to stable kernel trees
  • 2024-06-21: advisory: CVE-2024-38659 published

References

Related threats