CVE-2024-27414

What it actually does

Flaw in rtnl_bridge_setlink allows the NLA attribute pointer to reference an invalid or final attribute after loop iteration, causing memcpy of bridge flags to write beyond intended buffer and trigger memory corruption.

Why it matters to the business

Potential kernel memory corruption on systems processing bridge netlink messages could lead to crashes, privilege escalation, or system instability; low exploit maturity and absence from known campaigns reduce immediate operational risk despite widespread Linux kernel use.

How an attack unfolds

An attacker sends crafted RTM_SETLINK netlink messages containing IFLA_BRIDGE_FLAGS and other attributes; the flawed loop leaves the attr pointer at the last attribute, so the subsequent memcpy writes flags into adjacent memory, enabling corruption.

How to fix it

Upgrade the Linux kernel to the commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c or later that introduces the br_flag variable to correctly preserve the IFLA_BRIDGE_FLAGS NLA pointer before the memcpy.

How to confirm the fix worked

Confirm the kernel source contains the br_flag pointer assignment and uses it for the flags write-back; verify the vulnerable loop logic is replaced and test with crafted netlink messages that previously triggered the overflow.

Typical attack path

1. Craft malicious netlink RTM_SETLINK message with IFLA_BRIDGE_FLAGS and additional attributes
2. Deliver message via local netlink socket to trigger rtnl_bridge_setlink
3. Trigger the erroneous attr pointer advancement and memcpy overflow write
4. Leverage resulting memory corruption for denial of service or further exploitation

How to detect it

Review netlink message logs and kernel audit records for unusual RTM_SETLINK operations involving bridge attributes; inspect for unexpected kernel oops or memory corruption traces near rtnl_bridge_setlink.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all affected systems
• Monitor upstream stable kernel releases for backports
• Restrict unprivileged netlink access where feasible until patched