CVE-2024-38659 – This vulnerability in the Linux kernel's enic d... (How to Fix)

Q: What is the severity of CVE-2024-38659?

CVE-2024-38659 has a CVSS score of 7.1 (HIGH). This vulnerability in the Linux kernel's enic driver allows out-of-bounds read access when processing network link attributes. Attackers with local access could potentially read kernel memory, leading to information disclosure or system crashes. Systems using Cisco VIC Ethernet NICs with the enic driver are affected.

📋 TL;DR

This vulnerability in the Linux kernel's enic driver allows out-of-bounds read access when processing network link attributes. Attackers with local access could potentially read kernel memory, leading to information disclosure or system crashes. Systems using Cisco VIC Ethernet NICs with the enic driver are affected.

💻 Affected Systems

Products:

Linux kernel with enic driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Cisco VIC Ethernet NIC hardware and enic driver usage. Systems without this hardware are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation or system crash via kernel panic.

🟠

Likely Case

Information disclosure of kernel memory contents or system instability/crash.

🟢

If Mitigated

Limited impact if proper access controls prevent local attackers from accessing network configuration interfaces.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local attackers or compromised accounts could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to manipulate network link attributes via rtnetlink.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 25571a12fbc8a1283bd8380d461267956fd426f7 or later

Vendor Advisory: https://git.kernel.org/stable/c/25571a12fbc8a1283bd8380d461267956fd426f7

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify enic driver is using patched code.

🔧 Temporary Workarounds

Disable VF port configuration

linux

Prevent configuration of virtual function ports via rtnetlink

echo 0 > /sys/class/net/[interface]/device/sriov_numvfs

Restrict rtnetlink access

linux

Limit which users can modify network configurations via capability restrictions

setcap -r /sbin/ip
chmod 750 /sbin/ip

🧯 If You Can't Patch

Restrict local user access to systems with Cisco VIC hardware
Implement strict capability controls for network configuration tools

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if enic driver is loaded: lsmod | grep enic && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and enic driver version

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes when configuring VF ports
Unexpected memory access errors in kernel logs

Network Indicators:

Abnormal rtnetlink traffic from unauthorized users

SIEM Query:

source="kernel" AND ("enic" OR "out of bounds" OR "general protection fault")

📊 Metadata

CVE ID: CVE-2024-38659

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-1284

Published: June 21, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-38659, you might also want to check these: