CVE-2024-38659

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length vali...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= f8bd909183acffad68780b10c1cdf36161cfd5d1 < 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < 3c0d36972edbe56fcf98899622d9b90ac9965227, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < 25571a12fbc8a1283bd8380d461267956fd426f7, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < 7077c22f84f41974a711604a42fd0e0684232ee5, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < f6638e955ca00c489894789492776842e102af9c, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < aee1955a1509a921c05c70dad5d6fc8563dfcb31, >= f8bd909183acffad68780b10c1cdf36161cfd5d1 < e8021b94b0412c37bcc79027c2e382086b6ce449, >= 2.6.35, < V3.1, >= 2.6.35 < 4.19.316, >= 4.20 < 5.4.278, >= 5.5 < 5.10.219, >= 5.11 < 5.15.161, >= 5.16 < 6.1.93, >= 6.2 < 6.6.33, >= 6.7 < 6.9.4, 6.10

Fixed versions

4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-1284