CVE-2024-36957

What it actually does

The kernel function performed an off-by-one read by calling memdup_user with count+1 bytes while userspace supplied and verified only count bytes, risking access to unverified or unmapped memory; the fix replaces it with memdup_user_nul to guarantee NUL termination without over-reading.

Why it matters to the business

Linux kernel systems may experience crashes, information leaks, or unexpected behavior when interacting with the affected driver, potentially disrupting network or hardware-related workloads on servers and embedded devices until patched.

How an attack unfolds

An attacker invokes the vulnerable ioctl or sysfs path in octeontx2-af, supplying a buffer sized exactly to the reported count; the kernel then attempts to copy count+1 bytes, which can read past the end of the user-provided buffer and into adjacent kernel or unmapped memory, enabling crashes or limited information disclosure.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.217 or apply the commit bcdac70adceb44373da204c3c297f2a98e13216e; rebuild and reboot with the updated kernel image.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed release, verify the commit is present in the source tree, and test that the previously vulnerable interface now uses memdup_user_nul without over-reading.

Typical attack path

1. Identify a system running an unpatched Linux kernel with the octeontx2-af driver loaded.
2. Craft a userspace call supplying a buffer of exactly 'count' bytes to the affected interface.
3. Trigger the kernel path that performs the memdup_user(count+1) operation.
4. Observe resulting kernel oops, panic, or side-channel information from the over-read.

How to detect it

Review kernel logs for oops or panic messages referencing octeontx2-af or memdup_user around the time of suspected activity; correlate with process execution attempting to access the driver sysfs or ioctl interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing the octeontx2-af driver.
• Monitor vendor advisories for backported fixes in distribution kernels.
• Restrict untrusted userspace access to the affected hardware interfaces until patched.