LiveActive security incident?Get immediate response
CVE Record

CVE-2024-38659: enic: Validate length of nl attributes in enic_set_vf_port

In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port.

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user could abuse malformed network configuration data when the Linux Cisco enic driver configures a virtual-function port. The driver may read beyond the supplied data, potentially exposing information, corrupting limited state, or disrupting the host. Systems not using enic are unlikely to reach the vulnerable code.

Executive priority

Treat as high priority on multi-user, hosting, or virtualization systems that actively use enic and expose local access to less-trusted users. For systems without enic hardware or VF port configuration, validate non-exposure and handle through the normal kernel patch cycle.

Technical view

enic_set_vf_port assumes three netlink attributes have exact fixed lengths, while rtnetlink policy validation enforces only maximum lengths. Short IFLA_PORT_PROFILE, IFLA_PORT_INSTANCE_UUID, or IFLA_PORT_HOST_UUID values can therefore reach fixed-size memcpy operations and cause an out-of-bounds read. CVSS 3.1 is 7.3: local, low-complexity, low-privilege, no user interaction.

Likely exposure

Exposure is concentrated in Linux hosts using the enic network driver and virtual-function port configuration. The record traces affected code to Linux 2.6.35 and supplies fixes across multiple stable branches. Exact applicability requires checking the running distribution kernel because vendors may backport fixes without adopting upstream version numbers.

Exploitation context

The supplied sources provide no evidence of active exploitation, and the CVE is not listed as KEV. The supplied CVSS vector describes a local attack requiring low privileges, with no user interaction. It does not support classifying this as a network-reachable vulnerability.

Researcher notes

The central defect is an exact-length assumption crossing a validation boundary that permits shorter attributes. The stated failure is an out-of-bounds read during memcpy; the bundle does not establish a reliable exploitation primitive or observed attacks. Distribution-specific backports make commit-level verification more dependable than version-string comparison alone.

Mitigation direction

  • Apply the distributor kernel update containing the applicable upstream stable fix.
  • Prioritize shared hosts using enic, SR-IOV, or virtual-function port management.
  • Until updated, restrict untrusted local access and authority to change VF port configuration.
  • If package status is unclear, obtain CVE-specific remediation guidance from the system vendor.

Validation and detection

  • Inventory running kernels and determine whether the enic driver is loaded and actively used.
  • Check vendor advisories or package changelogs for CVE-2024-38659 or a referenced fix commit.
  • Identify systems where less-trusted local users can initiate VF port configuration changes.
  • After updating, confirm the fixed kernel is running and repeat vulnerability assessment.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38659 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2024-38659Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1, f8bd909183acffad68780b10c1cdf36161cfd5d1unaffected
LinuxLinux2.6.35, 0, 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.