LiveActive security incident?Get immediate response
CVE Record

CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()

In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read. BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0 mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-string.h:210 [inline] in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910 drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]--- Fix it by adding a check of string length before using it.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user with limited privileges may trigger a Linux kernel out-of-bounds read while configuring bonding ARP targets. This can expose kernel memory or disrupt the system. Network-reachable exploitation is not indicated; affected systems require the vulnerable kernel code and access to the relevant bonding configuration interface.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially for shared Linux hosts or capability-rich containers. It is not presented as an internet-scale emergency because exploitation requires local access and active exploitation is unsupported. Schedule prompt updates through normal tested maintenance, with faster handling for systems allowing less-trusted users to administer networking.

Technical view

An empty string passed to bond_option_arp_ip_targets_set() causes newval->string+1 to reference memory beyond the string. Subsequent parsing reaches strlen(), producing a one-byte slab out-of-bounds read. The kernel fix validates string length before use. The supplied CVSS 3.1 score is 7.1: local, low complexity, low privileges, with confidentiality and availability impact.

Likely exposure

Exposure is most plausible on affected Linux kernels where bonding is available and a low-privileged local actor can write the relevant sysfs option. The supplied affected-version data spans multiple kernel lines from 3.13 through 6.10, but exact downstream distribution status must be confirmed with each vendor.

Exploitation context

The source bundle provides a KASAN crash trace from automated testing, not evidence of attacks. CISA KEV status is false, and no cited source establishes active exploitation or a public weaponized exploit. The local access requirement materially limits reach, although multi-user systems and workloads granting network-administration capabilities deserve closer attention.

Researcher notes

The demonstrated fault is a one-byte read beyond an empty string during IPv4 target parsing. The supplied impact assessment permits confidentiality and availability effects, but the sources do not demonstrate reliable data disclosure, privilege escalation, or code execution. Version metadata contains repeated commit identifiers and broad affected entries, so branch-specific status should be verified against stable commits and distribution advisories.

Mitigation direction

  • Update to a vendor-supported kernel package containing the referenced upstream or stable backport.
  • Consult the Linux distribution advisory or package changelog to identify the fixed build for each kernel line.
  • Limit local users and workloads able to modify bonding configuration until updates are deployed.
  • Prioritize shared hosts or containers granted network-administration capabilities.

Validation and detection

  • Inventory running kernel versions and identify systems using or exposing Linux bonding configuration.
  • Confirm the vendor package contains the applicable stable fix or downstream backport.
  • Review permissions and capabilities controlling writes to bonding sysfs options.
  • Verify systems booted into the corrected kernel after maintenance.
  • Check security telemetry for matching KASAN or slab out-of-bounds reports where instrumentation exists.
Prepared
Confidence
high
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-39487 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2024-39487Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42, f9de11a165943a55e0fbda714caf60eaeb276a42unaffected
LinuxLinux3.13, 0, 4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.