CVE-2024-39487 in Linux
Summary
by MITRE • 07/09/2024
In the Linux kernel, the following vulnerability has been resolved:
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0 mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-string.h:210 [inline]
in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910 drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2020 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]---
Fix it by adding a check of string length before using it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/27/2024
The vulnerability identified as CVE-2024-39487 resides within the Linux kernel's bonding driver, specifically in the function bond_option_arp_ip_targets_set(). This flaw represents a classic out-of-bounds read condition that arises from insufficient input validation when processing network configuration parameters. The bonding driver is responsible for managing network interface aggregation, allowing multiple network interfaces to be combined into a single logical interface to improve performance and redundancy. The vulnerability manifests when the function receives an empty string as input through the newval->string parameter, which leads to a pointer arithmetic error where newval->string+1 attempts to access memory beyond the allocated string boundary.
The technical execution of this vulnerability occurs during the processing of ARP IP target configuration parameters within the bonding module. When the system encounters an empty string input, the code path triggers a call to strlen function through in4_pton, which subsequently accesses memory at an offset that extends beyond the valid string boundaries. This memory access pattern is detected by the Kernel Address Sanitizer (KASAN) mechanism, which identifies the out-of-bounds read operation as a potential security risk. The stack trace reveals the call sequence leading to the issue, starting from the sysfs interface where network bonding options are configured, passing through the bonding option setting functions, and ultimately reaching the string processing routines where the out-of-bounds access occurs.
The operational impact of this vulnerability extends beyond simple memory corruption, as it presents potential attack vectors that could be exploited to achieve privilege escalation or denial of service conditions within kernel space. An attacker who can manipulate the bonding configuration through the sysfs interface could potentially trigger this condition to corrupt kernel memory, leading to system instability or exploitation for privilege elevation. The vulnerability affects systems running Linux kernel versions where the bonding driver is active and configured, making it particularly concerning for network infrastructure servers and systems that utilize network bonding for high availability or performance optimization. According to CWE classification, this represents a CWE-129: Improper Validation of Array Index vulnerability, as the code fails to validate that the string length is sufficient before performing pointer arithmetic operations.
Mitigation strategies for this vulnerability should focus on implementing proper input validation within the bond_option_arp_ip_targets_set() function to ensure that string length checks occur before any pointer arithmetic operations are performed. The fix requires adding a length validation check to verify that newval->string is not empty before proceeding with operations that assume valid string content. This aligns with the ATT&CK framework's defense evasion techniques, as proper input validation prevents exploitation of memory corruption vulnerabilities. System administrators should prioritize applying the kernel patches that address this specific issue, while also implementing monitoring for unusual bonding configuration changes that might indicate attempted exploitation. The vulnerability underscores the importance of rigorous input validation in kernel space code, particularly for drivers that interface with user-space configuration mechanisms through sysfs interfaces. Organizations should conduct vulnerability assessments to identify systems running affected kernel versions and ensure that proper security updates are deployed to prevent potential exploitation of this out-of-bounds read condition.