CVE-2024-35944

What it actually does

The flaw permits a memcpy call in dg_dispatch_as_host to perform a field-spanning write that exceeds the declared size of the vmci_datagram structure member, copying payload bytes into the adjacent flexible array member and triggering FORTIFY_SOURCE runtime warnings.

Why it matters to the business

Kernel log spam, potential stability issues on systems using VMCI datagrams, and added maintenance overhead for organizations running affected Linux kernels; low immediate risk given the local attack vector and absence from known exploited lists.

How an attack unfolds

An attacker with local access crafts a VMCI datagram whose payload_size field causes the total size to exceed the vmci_datagram structure, then submits it through the VMCI host dispatch path; the oversized memcpy triggers the compiler hardening check without further remote or privilege-escalation steps.

How to fix it

Upgrade the Linux kernel to the commit e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051 or later stable releases that split the memcpy into separate structure assignment and payload copy operations.

How to confirm the fix worked

Confirm the running kernel contains commit e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051 or verify the patched dg_dispatch_as_host function no longer performs the field-spanning memcpy; re-run Syzkaller-style fuzzing targeting VMCI datagrams to ensure the warning is absent.

Typical attack path

1. Obtain local access to a system exposing the VMCI device
2. Allocate and populate a datagram structure with payload_size set to exceed the 24-byte msg field
3. Invoke the datagram dispatch path that reaches dg_dispatch_as_host
4. Observe the runtime warning or any resulting side effects from the oversized copy

How to detect it

Search kernel logs and audit trails for FORTIFY_SOURCE warnings mentioning dg_dispatch_as_host or vmci_datagram.c; examine process activity that interacts with /dev/vmci or sends datagrams with anomalous payload sizes.

What your security team should do

• Prioritize kernel updates on any hosts that expose or rely on the VMCI subsystem
• Monitor kernel logs for FORTIFY_SOURCE warnings referencing vmci_datagram.c
• Apply the fix within normal patch cycles given the low EPSS and lack of KEV listing