Executive brief
A vulnerability exists in the Linux kernel's BFA SCSI driver, which manages certain storage hardware connections. A local attacker could exploit this flaw to read sensitive information from the system's memory or cause a system crash. This could lead to unauthorized data access or a disruption of services on affected Linux systems.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the Linux kernel BFA SCSI driver within the bfad_debugfs.c component. The functions bfad_debugfs_write_regrd and bfad_debugfs_write_regwr use memdup_user to copy a buffer from userspace but fail to ensure the resulting kernel buffer is NUL-terminated. Subsequent calls to sscanf on this non-terminated buffer can result in an OOB read. A local user with access to these debugfs entries can trigger the flaw to leak kernel memory or cause a kernel panic. The issue has been resolved by replacing memdup_user with memdup_user_nul to guarantee proper string termination.
Affected products
- Linux Linux Kernel 3.19 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-04-24: other: Patch authored
- 2024-06-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a
- https://git.kernel.org/stable/c/13d0cecb4626fae67c00c84d3c7851f6b62f7df3
- https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf
- https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35
- https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462
- https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2
- https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec3334b4143