CVE-2024-41091: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-41091 Overview

CVE-2024-41091 is a Linux kernel vulnerability in the TUN/TAP virtual network driver. The flaw resides in the tun_xdp_one() code path, which fails to validate that incoming frames meet the minimum Ethernet header size (ETH_HLEN). A local user with privileges to access a TUN device can submit a short frame that triggers out-of-bounds memory access when eth_type_trans() parses the Ethernet header. The corrupted socket buffer (skb) is then propagated downstack with inconsistent metadata, which can confuse lower network layers. The issue is tracked as [CWE-125] (Out-of-bounds Read) and affects multiple stable Linux kernel branches.

Critical Impact
A local attacker with TUN device access can trigger out-of-bounds reads and kernel instability, leading to denial of service or potential memory disclosure.

Affected Products

Linux Kernel (multiple stable branches prior to patched commits)
Debian LTS distributions shipping vulnerable kernels
Downstream distributions and virtualization platforms relying on TUN/TAP with XDP

Discovery Timeline

2024-07-29 - CVE-2024-41091 published to NVD
2025-01 - Debian LTS advisory released addressing the issue
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-41091

Vulnerability Analysis

The vulnerability stems from missing frame-length validation in the TUN driver's XDP (eXpress Data Path) processing routine. When a user-space process submits packets through the tun_xdp_one() path, the kernel constructs an skb and immediately calls eth_type_trans() to determine the protocol. This helper assumes the buffer contains a complete Ethernet header of at least 14 bytes. The cited commit that introduced the XDP fast path omitted the size check present in the alternative tun_get_user() path. As a result, frames shorter than ETH_HLEN reach eth_type_trans() and cause reads past the actual packet boundary.

Root Cause

The defect is an input validation oversight in drivers/net/tun.c. The original tun_get_user() function rejects frames smaller than the Ethernet header for IFF_TAP devices, but the XDP-accelerated counterpart tun_xdp_one() did not replicate this guard. The fix adds an equivalent length check that drops any frame shorter than ETH_HLEN before further processing.

Attack Vector

Exploitation requires local access and the ability to open or interact with a TUN/TAP device, typically granted to users with CAP_NET_ADMIN or membership in a privileged group. An attacker crafts a malformed short frame and writes it through the XDP submission interface. The kernel then reads beyond the buffer in eth_type_trans(), which can crash the system, corrupt subsequent network processing, or leak adjacent memory contents to downstream layers. The vulnerability cannot be triggered remotely without prior local privileges.

No verified public proof-of-concept code is available. Refer to the upstream patch commits for the precise code change and reproducer context.

Detection Methods for CVE-2024-41091

Indicators of Compromise

Unexpected kernel oops or panic messages referencing tun_xdp_one, eth_type_trans, or skb corruption in dmesg and /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging slab-out-of-bounds reads inside the TUN driver.
Abnormal traffic patterns originating from TAP interfaces containing sub-14-byte Ethernet frames.

Detection Strategies

Audit running kernel versions against the fixed commits listed in the kernel.org stable references to identify unpatched hosts.
Monitor processes that open /dev/net/tun and submit XDP frames, correlating with unprivileged or unexpected accounts.
Enable kernel lockdown and audit subsystem rules to log TUN device access attempts.

Monitoring Recommendations

Forward auditd and kernel ring buffer logs to a centralized SIEM for correlation of TUN-related faults.
Track CAP_NET_ADMIN grants and namespace creation events that enable TUN device usage in containers.
Alert on repeated kernel warnings or crashes on hypervisor and container hosts that rely on TAP networking.

How to Mitigate CVE-2024-41091

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that includes the upstream fix.
Inventory hosts running virtualization workloads (KVM/QEMU, containers, VPNs) that depend on TUN/TAP and prioritize patching.
Restrict access to /dev/net/tun and CAP_NET_ADMIN to trusted service accounts only.

Patch Information

The fix is committed across multiple stable Linux kernel branches. Reference patches include commit ad6b3f6, commit 6100e02, and commit 8418f55. Debian users should consult the Debian LTS Announcement January 2025 for distribution-specific package versions.

Workarounds

Disable XDP attachment on TAP interfaces where it is not required for performance-critical workloads.
Remove or restrict TUN/TAP device permissions for non-essential users and unprivileged containers.
Apply seccomp or AppArmor profiles that prevent untrusted workloads from opening /dev/net/tun.

bash

# Verify the running kernel and check for the patched TUN driver
uname -r
modinfo tun | grep -E 'version|filename'

# Restrict access to the TUN control device
chmod 0660 /dev/net/tun
chown root:netdev /dev/net/tun