CVE-2024-38538: Linux Kernel Use-After-Free Vulnerability

CVE-2024-38538 Overview

CVE-2024-38538 is a kernel vulnerability in the Linux bridge networking subsystem. The flaw exists in the br_dev_xmit function within net/bridge/br_device.c. An attacker can submit a socket buffer (skb) smaller than ETH_HLEN to trigger access of uninitialized memory in the bridge transmit path. The issue was discovered by syzbot through KMSAN instrumentation and reported as an uninitialized value read. The vulnerability is classified under [CWE-908: Use of Uninitialized Resource].

Critical Impact

A local user with the ability to inject crafted packets through eBPF or bridge interfaces can trigger kernel memory disclosure and denial of service conditions on affected Linux systems.

Affected Products

• Linux Kernel (multiple stable branches prior to fix commits)
• Debian LTS distributions shipping vulnerable kernel versions
• Any Linux distribution using the bridge networking module without the upstream patch

Discovery Timeline

• 2024-06-19 - CVE-2024-38538 published to NVD
• 2025-03 - Debian LTS security announcement issued
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-38538

Vulnerability Analysis

The vulnerability resides in the Linux bridge device transmit path at br_dev_xmit+0x61d/0x1cb0 in net/bridge/br_device.c:65. The function assumed that incoming socket buffers contained at least an Ethernet header worth of data, equal to ETH_HLEN (14 bytes). When an skb shorter than this minimum was forwarded into the bridge xmit path, the code read beyond the validated portion of the buffer. KMSAN flagged this as an uninitialized value read, confirming that the kernel was dereferencing memory that had not been populated by the caller.

Root Cause

The root cause is missing input validation on skb length before pulling Ethernet header bytes. The original code did not call a length check or pskb_may_pull(skb, ETH_HLEN) before parsing header fields. The fix introduces an explicit check so the bridge driver verifies sufficient data exists before processing. Buffers that fail the check are now dropped with the PKT_TOO_SMALL drop reason, which is observable via dropwatch.

Attack Vector

The vulnerability requires local access and low privileges. The syzbot reproducer triggered the flaw through the eBPF bpf_clone_redirect helper, which redirected a short skb into the bridge transmit path via __bpf_redirect and dev_queue_xmit. An attacker with permission to load eBPF programs or send raw packets to a bridge interface can reach the vulnerable code path. Successful exploitation leads to reads of uninitialized kernel memory and potential kernel panic, impacting confidentiality and availability of the host.

The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit 1abb371 and the Debian LTS Announcement for technical details.

Detection Methods for CVE-2024-38538

Indicators of Compromise

• dropwatch entries showing drops at br_dev_xmit with reason PKT_TOO_SMALL and protocol 0x88a8 or other unusual EtherTypes
• KMSAN or KASAN reports referencing br_dev_xmit and uninitialized value reads in kernel logs
• Unexpected kernel oops or panic traces involving __bpf_redirect, bpf_clone_redirect, or dev_hard_start_xmit paths

Detection Strategies

• Inventory Linux hosts and identify kernel versions that predate the fix commits referenced in the NVD advisory
• Audit loaded eBPF programs that invoke bpf_clone_redirect or write to bridge interfaces from non-privileged contexts
• Monitor for short-frame anomalies on bridge interfaces using tc or nftables counters

Monitoring Recommendations

• Enable dropwatch or perf tracing on production hosts running bridged networking to surface PKT_TOO_SMALL events
• Forward kernel ring buffer messages to a centralized log platform and alert on bridge subsystem oops traces
• Track CAP_BPF and CAP_NET_ADMIN capability grants across container and VM workloads

How to Mitigate CVE-2024-38538

Immediate Actions Required

• Apply the latest kernel update from your Linux distribution that includes the upstream fix commits
• Restrict the ability to load eBPF programs by limiting CAP_BPF and CAP_SYS_ADMIN to trusted users
• Audit container runtimes and unprivileged user namespaces that may expose bridge transmit paths to attackers

Patch Information

The upstream fix adds a length check before pulling the Ethernet header in br_dev_xmit. Patch commits are available at Kernel Git Commit 1abb371, Kernel Git Commit 28126b8, Kernel Git Commit 5b5d669, Kernel Git Commit 8bd67eb, and Kernel Git Commit f482fd4. Debian users should consult the Debian LTS Announcement.

Workarounds

• Disable the bridge kernel module on systems that do not require Layer 2 bridging using modprobe -r bridge and blacklist it
• Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged eBPF program loading
• Apply seccomp or AppArmor profiles to container workloads to block raw socket and bridge management syscalls

# Configuration example
# Disable unprivileged eBPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-cve-2024-38538.conf

# Verify installed kernel version
uname -r

# Remove bridge module if not required
modprobe -r bridge
echo 'blacklist bridge' > /etc/modprobe.d/blacklist-bridge.conf