CVE-2025-39998

Vulnerability

Analysis

The vulnerability resides in the target_lu_gp_members_show function in drivers/target/target_core_configfs.c. The function uses snprintf to write a formatted string (HBA name, slash, device name, newline) into a stack buffer buf of size LU_GROUP_NAME_BUF (256 bytes). While snprintf limits the number of bytes written to the buffer, it returns the total number of bytes that would have been written if the buffer were large enough. This returned length is subsequently passed to memcpy without validation, causing a buffer overflow when the concatenated string exceeds 256 bytes [1][2][3][4].

Exploitation

Triggering the overflow requires the ability to set long HBA or device names via the configfs interface. This typically demands privileged access (root or CAP_SYS_ADMIN) on the host system. The SCSI target subsystem is often used in storage environments; an attacker with local admin rights can craft names that produce an output longer than 256 bytes, leading to a write beyond the buffer bounds.

Impact

A buffer overflow can corrupt adjacent memory, potentially causing a denial of service (system crash) or, in more severe cases, enabling an attacker to elevate privileges or execute arbitrary code. The exact impact depends on the memory layout and protection mechanisms.

Mitigation

The fix adds a length check on the return value of snprintf and truncates the output accordingly. Patches have been applied to multiple stable kernel branches as referenced in [1][2][3][4].