CyberSecBulletin
CVE-2024-38659NVD status: Modified

Linux: Improper Validation of Specified Quantity in Input

Published Updated By the CyberSecBulletin desk

CVE-2024-38659 is a high-severity improper validation of specified quantity in input vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600, ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d, 3c0d36972edbe56fcf98899622d9b90ac9965227 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600 or ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d or 3c0d36972edbe56fcf98899622d9b90ac9965227 or 25571a12fbc8a1283bd8380d461267956fd426f7, whichever matches your release line, or a later version.
  2. Update RUGGEDCOM RST2428P to V3.1 or a later version.
  3. Update SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.1 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxf8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, 3c0d36972edbe56fcf98899622d9b90ac9965227; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, 25571a12fbc8a1283bd8380d461267956fd426f7; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, 7077c22f84f41974a711604a42fd0e0684232ee5; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, f6638e955ca00c489894789492776842e102af9c; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, aee1955a1509a921c05c70dad5d6fc8563dfcb31; f8bd909183acffad68780b10c1cdf36161cfd5d1 up to, but not including, e8021b94b0412c37bcc79027c2e382086b6ce449; and 1 more ranges2b649d7e0cb42a660f0260ef25fd55fdc9c6c600, ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d, 3c0d36972edbe56fcf98899622d9b90ac9965227, 25571a12fbc8a1283bd8380d461267956fd426f7, 7077c22f84f41974a711604a42fd0e0684232ee5, f6638e955ca00c489894789492776842e102af9c
SiemensRUGGEDCOM RST2428Pbefore V3.1V3.1
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familyNot specified in the recordNot stated
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 familybefore V3.1V3.1
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
LinuxLinux Kernel2.6.35 up to, but not including, 4.19.316; 4.20 up to, but not including, 5.4.278; 5.5 up to, but not including, 5.10.219; 5.11 up to, but not including, 5.15.161; 5.16 up to, but not including, 6.1.93; 6.2 up to, but not including, 6.6.33; 6.7 up to, but not including, 6.9.4; 6.104.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.3HighCNA
CVSS 3.17.1HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

More Improper Validation of Specified Quantity in Input vulnerabilities (CWE-1284)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Specified Quantity in Input vulnerabilities

Spotted an error? Tell us.