CVE-2024-39487

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.7.0-rc7

Description The issue is related to an out-of-bounds read in the bond option arp ip targets set() function. If newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read. This can be fixed by adding a check of string length before using it. The vulnerability may allow an attacker to impact the confidentiality and availability of protected information.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the out-of-bounds read in bond option arp ip targets set(). As a temporary workaround, consider disabling the bond option arp ip targets set() function until a patch is available.