CVE-2024-38659

What it actually does

Out-of-bounds read via memcpy in enic_set_vf_port when netlink attributes IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID and IFLA_PORT_HOST_UUID are shorter than the assumed fixed sizes because nla_policy only enforces maximum lengths.

Why it matters to the business

Local memory disclosure or kernel crashes on Linux systems using the enic driver can disrupt network virtualization, virtual functions, and cloud or data-center workloads until systems are patched.

How an attack unfolds

A local attacker sends a crafted rtnetlink message containing undersized IFLA_PORT_* attributes; do_setlink accepts the message per policy, then enic_set_vf_port performs memcpy of the shorter data into fixed-size buffers, reading past the end of the attribute payload.

How to fix it

Upgrade the Linux kernel to commit 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600 or any later stable release that adds explicit length validation before the memcpy calls in enic_set_vf_port.

How to confirm the fix worked

Confirm the patch is present by inspecting enic_set_vf_port for nla_len checks matching exact expected sizes; run kernel regression tests that exercise VF port configuration with variable-length attributes.

Typical attack path

1. Obtain local shell or user privileges on a vulnerable Linux kernel
2. Construct netlink rtnetlink message with IFLA_PORT_PROFILE or UUID attributes shorter than PORT_PROFILE_MAX/PORT_UUID_MAX
3. Invoke do_setlink which calls enic_set_vf_port
4. Trigger memcpy that performs out-of-bounds read

How to detect it

Review audit logs and netlink traces for rtnetlink SETLINK operations on VF ports with attribute lengths below expected maxima; inspect kernel logs for enic-related oops or slab-out-of-bounds warnings.

What your security team should do

• Apply the referenced kernel commit to all systems using the enic driver
• Prioritize patching production virtualization hosts and cloud instances first
• Restrict unprivileged users from netlink operations via capabilities or SELinux policy until updated