CVE-2024-36920

What it actually does

False-positive kernel warning triggered by memcpy of 128 bytes into a single-byte fixed array declared inside mpi3mr_bsg_in_reply_buf instead of a proper flexible-array member, occurring on storcli2 show commands against eHBA-9600 adapters.

Why it matters to the business

Produces noisy kernel warnings on systems using Broadcom mpi3mr HBAs; no data loss or privilege escalation but increases alert fatigue and may complicate log monitoring in storage fleets.

How an attack unfolds

An attacker with local access or the ability to trigger storcli2 show commands can cause the mpi3mr driver to execute the memcpy path, surfacing the field-spanning write warning; no malicious payload or privilege gain is possible because the warning is a compile-time/runtime false positive.

How to fix it

Update the Linux kernel to a version containing commit 5f0266044dc611563539705bff0b3e1545fbb6aa (or later stable backport) which changes the reply_buf array declaration to a true flexible array member and adjusts the allocation size accordingly.

How to confirm the fix worked

After patching, run storcli2 show on the affected adapter and confirm the field-spanning write WARNING no longer appears in dmesg or kernel logs; verify the struct declaration in mpi3mr_app.c uses [] instead of [1].

Typical attack path

1. Obtain local shell or trigger management command on affected host
2. Execute storcli2 show against mpi3mr-managed eHBA-9600
3. Kernel logs the memcpy field-spanning write warning at mpi3mr_app.c:1658

How to detect it

Search kernel logs (dmesg, journalctl, /var/log/kern.log) for the exact string "memcpy: detected field-spanning write" together with "mpi3mr_bsg_request" and "bsg_reply_buf"; presence indicates the unpatched driver path was exercised.

• memcpy: detected field-spanning write (size 128) of single field "bsg_reply_buf->reply_buf"
• WARNING: CPU.*at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request

What your security team should do

• Prioritize kernel upgrade on any host exposing mpi3mr HBAs to management tools
• Add the fixed commit hash to internal kernel build manifests
• Suppress or rate-limit the specific warning string in centralized logging until patches are deployed