CVE-2024-36017 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
A missing size check in the Linux kernel's rtnetlink allows out-of-bounds reads, potentially leading to information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36017?
CVE-2024-36017 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 30 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl.
Which versions are affected by CVE-2024-36017?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-36017?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-36017 being exploited?
There is no known exploitation of CVE-2024-36017 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-36017, DEBIAN-CVE-2024-36017, UBUNTU-CVE-2024-36017.