CVE-2024-38659

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> enic: Validate length of nl attributes in enic_set_vf_port<br /> <br /> enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE<br /> is of length PORT_PROFILE_MAX and that the nl attributes<br /> IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX.<br /> These attributes are validated (in the function do_setlink in rtnetlink.c)<br /> using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE<br /> as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and<br /> IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation<br /> using the policy is for the max size of the attributes and not on exact<br /> size so the length of these attributes might be less than the sizes that<br /> enic_set_vf_port expects. This might cause an out of bands<br /> read access in the memcpys of the data of these<br /> attributes in enic_set_vf_port.