Out-of-Bounds Read Vulnerability in Linux Package: CVE-2024-39487
Summary
DEBIAN-CVE-2024-39487: In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string,... Affects linux versions < 5.10.223-1. Fixed in 5.10.223-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring system stability and performance. This vulnerability specifically affects the bonding driver within the Linux kernel, which is responsible for network interface bonding, allowing multiple network interfaces to be combined for redundancy or increased throughput.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the bonding driver, specifically in the function bond_option_arp_ip_targets_set(). When the input string newval->string is empty, the code attempts to access newval->string+1, leading to an out-of-bounds read. This can result in undefined behavior, including potential crashes or data leaks. The issue was reported as a KASAN (Kernel Address Sanitizer) error, indicating a slab-out-of-bounds read, which poses a significant risk to system integrity and security.
How To Fix
Minimum fixed version
5.10.223-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the bonding driver until the package is updated. This may involve reconfiguring network settings to use individual network interfaces instead of bonding.
Conclusion
The CVE-2024-39487 vulnerability in the Linux kernel's bonding driver poses a significant risk due to its potential for out-of-bounds reads. Users are advised to update their systems to the latest patched versions to ensure security and stability. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2024-39487 is a vulnerability in the Linux kernel's bonding driver that allows for an out-of-bounds read, potentially leading to system instability.
This vulnerability can cause crashes or data leaks, compromising system security and integrity.
Affected versions include Linux kernel versions prior to 5.10.223-1 for Debian 11, 6.1.99-1 for Debian 12, and 6.9.9-1 for Debian 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If immediate updates are not possible, consider disabling the bonding driver as a temporary measure to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
