01 Record

CVE-2024-38659

enic: Validate length of nl attributes in enic_set_vf_port

HighPUBLISHEDCNA: Linux

CNA base score7.3 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

View raw JSON

02 Description

enic: Validate length of nl attributes in enic_set_vf_port

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.24% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 15.5% of scored records. A rank, not a probability.

NVD base score

7.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-06-21 10:28Z2 YR AGO

Last updated

2026-10-15 00:43Z14 DAYS AGO

Reserved

2024-06-21

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.3)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weaknesses

CWE-1284Improper Validation of Specified Quantity in InputBase
CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

3319265f71e48fb761686a360dcc39a82a6cbb2a832699dede88b7fdc2085ab3

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxf8bd909183acffad68780b10c1cdf36161cfd5d1 to < 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < 3c0d36972edbe56fcf98899622d9b90ac9965227, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < 25571a12fbc8a1283bd8380d461267956fd426f7, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < 7077c22f84f41974a711604a42fd0e0684232ee5, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < f6638e955ca00c489894789492776842e102af9c, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < aee1955a1509a921c05c70dad5d6fc8563dfcb31, f8bd909183acffad68780b10c1cdf36161cfd5d1 to < e8021b94b0412c37bcc79027c2e382086b6ce449, 2.6.35—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/2b649d7e0cb42a660f0260ef25fd55fdc9c6c600
git.kernel.orghttps://git.kernel.org/stable/c/ca63fb7af9d3e531aa25f7ae187bfc6c7166ec2d
git.kernel.orghttps://git.kernel.org/stable/c/3c0d36972edbe56fcf98899622d9b90ac9965227
git.kernel.orghttps://git.kernel.org/stable/c/25571a12fbc8a1283bd8380d461267956fd426f7
git.kernel.orghttps://git.kernel.org/stable/c/7077c22f84f41974a711604a42fd0e0684232ee5
git.kernel.orghttps://git.kernel.org/stable/c/f6638e955ca00c489894789492776842e102af9c
git.kernel.orghttps://git.kernel.org/stable/c/aee1955a1509a921c05c70dad5d6fc8563dfcb31
git.kernel.orghttps://git.kernel.org/stable/c/e8021b94b0412c37bcc79027c2e382086b6ce449
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-613116.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.94-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.9.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.9.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.