CVE-2024-39487

What it actually does

Out-of-bounds read in strlen() triggered when bond_option_arp_ip_targets_set() receives an empty string via sysfs, causing newval->string+1 to reference memory past the allocation.

Why it matters to the business

Kernel memory corruption or crash on systems using Linux bonding with network interface configuration changes, increasing downtime risk for servers relying on link aggregation.

How an attack unfolds

An attacker with write access to bonding sysfs attributes supplies an empty string to the arp_ip_targets option, bypassing length checks and triggering the out-of-bounds read during in4_pton processing.

How to fix it

Upgrade the Linux kernel to commit 6a8a4fd082c439e19fede027e80c79bc4c84bb8e or later stable releases containing the length check before using the string pointer in bond_option_arp_ip_targets_set().

How to confirm the fix worked

Confirm kernel version includes the fix commit; attempt to store an empty string via the sysfs attribute and verify no KASAN report or oops occurs.

Typical attack path

1. Identify host with Linux bonding module loaded and sysfs writable
2. Write empty value to /sys/class/net/bond*/bonding/arp_ip_targets
3. Trigger strlen() and in4_pton() path leading to KASAN-detected slab-out-of-bounds read
4. Observe kernel panic or information disclosure in logs

How to detect it

Search kernel logs for KASAN slab-out-of-bounds reports mentioning strlen, in4_pton, bond_option_arp_ip_targets_set, or bond_options.c; inspect sysfs write audit logs for empty values written to arp_ip_targets.

• KASAN: slab-out-of-bounds in strlen+0x7d/0xa0
• bond_option_arp_ip_targets_set+0xc2/0x910
• Read of size 1 at addr .* by task .*
• sysfs write of empty string to bonding/arp_ip_targets

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on all systems using the bonding driver
• Restrict sysfs write access to bonding options via SELinux or file permissions where possible
• Monitor for kernel oops or KASAN reports referencing bond_options.c and strlen