CVE-2024-53082

A flaw was found in the Linux kernel's virtio_net network driver. The driver does not properly validate the hash key length during device initialization. A local user could exploit this vulnerability when setting or reading the hash key, triggering out-of-bounds memory access. This flaw primarily results in a Denial of Service (DoS) through a system crash, or potentially exposes sensitive kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the virtio_net kernel module from loading on systems where virtio network devices are not required:

1. Blacklist the module using the modprobe configuration:

echo "install virtio_net /bin/true" >> /etc/modprobe.d/disable-virtio_net.conf

2. If the module is currently loaded, attempt to unload it:

modprobe -r virtio_net

Caveats: Disabling the virtio_net driver prevents any virtio virtual network interfaces from functioning, disrupting network connectivity on virtual machines using this driver. A system reboot is required if the module is in active use and cannot be dynamically unloaded.