VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 19, 2024· Updated May 12, 2026

CVE-2024-38560

CVE-2024-38560

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Ensure the copied buf is NUL terminated

Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's bfa driver, a missing NUL termination in copied buffer leads to out-of-bounds read via sscanf.

Vulnerability

CVE-2024-38560 is a vulnerability in the Linux kernel's bfa (Brocade Fibre Channel Adapter) SCSI driver. The flaw is in the handling of user-supplied data: the bfa driver allocates a kernel buffer of nbytes size using memdup_user, copies data from userspace, and later parses it with sscanf. Because the copied buffer was not guaranteed to be NUL-terminated, sscanf could read beyond the allocated region, leading to an out-of-bounds (OOB) read.

Exploitation

An attacker with local access and sufficient privileges to interact with the bfa driver can trigger this bug. The attack requires passing a user-space buffer to the driver's copy routine that does not contain a NUL terminator within the copied nbytes range. When the driver subsequently calls sscanf on the buffer, the function may read past the end of the allocated memory, potentially exposing sensitive kernel data or causing a crash.

Impact

Successful exploitation results in an OOB read that could disclose kernel memory contents to an unprivileged user or cause a denial-of-service (system panic or hang). The severity is rated High (CVSS v3.1 7.1) due to the potential for information leakage and system instability.

Mitigation

The fix, committed to the Linux kernel stable branches, replaces memdup_user with memdup_user_nul, which ensures the copied buffer is always NUL-terminated [2][3][4]. System administrators should update to a kernel version containing the fix. The vulnerability also affects the SIMATIC S7-1500 TM MFP's GNU/Linux subsystem, as indicated by Siemens advisory SSA-265688 [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

223

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.