CVE-2025-38332 — Improper Null Termination in Linux
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 95.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 10
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Use memcpy() for BIOS version
The strlcat() with FORTIFY support is triggering a panic because it
thinks the target buffer will overflow although the correct target
buffer size is passed in.
Anyway, instead of memset() with 0 followed by a strlcat(), just use
memcpy() and ensure that the resulting buffer is NULL terminated.
BIOSVersion is only used for the lpfc_printf_log() which expects a
properly terminated str…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linuxb3b4f3e1d575fe142fd437158425c2359b695ff1 — ac7bfaa099ec3e4d7dfd0ab9726fc3bc7911365d+8
Also affects: Debian Linux 11.0