Loading vulnerability…
CVE-2024-39487 is an out-of-bounds read in the Linux kernel bonding driver, specifically in bond_option_arp_ip_targets_set() in drivers/net/bonding/bond_options.c. When processing arp_ip_target input, the function can dereference newval->string+1 without first validating that newval->string is non-empty. If the supplied string is empty, the code advances one byte past the end of the string and subsequently passes that invalid position into parsing logic, leading to an out-of-bounds read detected by KASAN in strlen()/in4_pton(). The issue is triggered through the bonding sysfs option handling path, as shown by the call chain through bonding_sysfs_store_option() and sysfs write handlers. The upstream fix adds a string-length check before using the incremented pointer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.