CVE-2024-23497

The vulnerability consists of an out-of-bounds write (CWE-787) in the Linux kernel-mode driver handling Intel Ethernet controllers and adapters. An attacker with local access to the system and regular user privileges can trigger an improper memory write operation in the kernel, which can lead to modification of critical operating system data structures. This makes it possible to obtain higher privileges than those the attacker originally possessed.

An authenticated local user can potentially obtain privilege escalation — in practice, it is possible to take full control of the operating system, including kernel-level access, which threatens the confidentiality, integrity, and availability of the entire system and related infrastructure.

The Linux driver for Intel Ethernet Network Controllers and Adapters should be updated to version 28.3 or later. Detailed information and patches are available in the Intel security advisory at: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00918.html

Linux kernel-mode driver for Intel Ethernet Network Controllers and Adapters prior to version 28.3 — affects devices with Intel Ethernet 800 Series Controllers Driver.