CVE-2024-36017

What it actually does

Insufficient validation of nested IFLA_VF_VLAN_LIST netlink attributes allows undersized data (less than 14 bytes) to be cast to struct ifla_vf_vlan_info, resulting in an out-of-bounds read when accessing fields of the casted structure.

Why it matters to the business

Linux systems may experience kernel memory disclosure or crashes during network interface configuration operations involving virtual functions, increasing exposure on servers and devices that manage VLAN or VF settings.

How an attack unfolds

An attacker with the ability to send rtnetlink messages crafts a nested IFLA_VF_VLAN_LIST attribute containing one or more sub-attributes smaller than sizeof(struct ifla_vf_vlan_info). The kernel's do_setvfinfo path validates only against NLA_HDRLEN and proceeds to cast and dereference the undersized data, triggering the out-of-bounds read.

How to fix it

Update the Linux kernel to a version containing commit 8ac69ff2d0d5be9734c4402de932aa3dc8549c1a or later that enforces the correct minimum attribute size of sizeof(struct ifla_vf_vlan_info) for entries inside IFLA_VF_VLAN_LIST.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or a backport that changes the validation constant from NLA_HDRLEN to sizeof(struct ifla_vf_vlan_info) inside do_setvfinfo; test by sending a deliberately undersized VLAN_INFO attribute and verifying the operation is rejected with EINVAL.

Typical attack path

1. Obtain capability to send NETLINK_ROUTE messages (typically requires CAP_NET_ADMIN or equivalent).
2. Construct a malformed RTM_SETLINK or equivalent message containing an IFLA_VFINFO_LIST with a nested IFLA_VF_VLAN_LIST.
3. Embed one or more IFLA_VF_VLAN_INFO attributes whose payload length is between 5 and 13 bytes.
4. Send the message to the kernel; the insufficient size check permits the cast and subsequent field access outside the allocated buffer.

How to detect it

Inspect kernel audit logs, netlink message traces, or system call auditing for RTM_SETLINK or RTM_NEWLINK operations that contain IFLA_VF_VLAN_LIST attributes; look for unusually small attribute lengths or repeated failed validation attempts in dmesg or security event logs.

What your security team should do

• Prioritize kernel updates on any system exposing netlink interfaces to untrusted processes or containers.
• Apply the fix listed for the stable tree commit 8ac69ff2d0d5be9734c4402de932aa3dc8549c1a across all affected distributions.
• Review systems for custom or legacy VF/VLAN configuration tooling that may trigger the code path.
• Monitor for future similar attribute-validation issues in rtnetlink handling.