Critical Vulnerability in Linux Kernel: Out of Bounds Read in enic_set_vf_port
Summary
DEBIAN-CVE-2024-38659: In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MA... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly complex and is continuously updated to address security vulnerabilities and improve functionality. This specific vulnerability affects the 'linux' package in Debian distributions, which is crucial for system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the function enic_set_vf_port. This function incorrectly assumes that certain netlink attributes are of fixed lengths, leading to potential out-of-bounds read access during memory operations. Specifically, the attributes IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID, and IFLA_PORT_HOST_UUID are not validated for exact sizes, which can result in unintended memory access and may compromise system integrity.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can limit access to the affected functionality or monitor the system for unusual behavior until the package is updated. However, this is not a permanent solution and should not replace applying the patch.
Conclusion
This report outlines a critical vulnerability in the Linux kernel related to improper validation of netlink attributes. It is essential for users of affected Debian distributions to apply the recommended updates to ensure system security and stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows for out-of-bounds read access due to improper validation of netlink attributes in the enic_set_vf_port function.
The vulnerability affects the Linux kernel in Debian versions 11, 12, 13, and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability could lead to unauthorized memory access, potentially compromising system stability and security.
Yes, the permanent fix is to update the Linux package to the specified patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
