CVE-2025-38332: scsi: lpfc: Use memcpy() for BIOS version
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Use memcpy() for BIOS version
The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in.
Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated.
BIOSVersion is only used for the lpfcprintflog() which expects a properly terminated string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Replace the strlcat() operation used for the BIOSVersion buffer with memcpy(), and ensure the resulting buffer is NULL terminated before passing it to lpfc_printf_log().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38332?
CVE-2025-38332 has a moderate severity level due to its potential to cause panic in the system.
How do I fix CVE-2025-38332?
To fix CVE-2025-38332, you should apply the latest Linux kernel updates that address this vulnerability.
What systems are affected by CVE-2025-38332?
CVE-2025-38332 affects the Linux kernel, specifically the SCSI lpfc driver.
What is the nature of the vulnerability in CVE-2025-38332?
The vulnerability in CVE-2025-38332 is caused by improper handling of buffer sizes in strlcat(), leading to potential kernel panic.
Is there a patch available for CVE-2025-38332?
Yes, there are patches available in the updates for the Linux kernel that resolve CVE-2025-38332.