LiveActive security incident?Get immediate response
CVE Record

CVE-2024-39482: bcache: fix variable length array abuse in btree_iter

In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-39482 is a Linux kernel bcache bug involving unsafe array sizing in an internal btree iterator. The public bundle does not provide CVSS, proven exploitability, or business impact. Treat it as a kernel maintenance risk, especially for systems using bcache or vendor appliances that include affected kernels.

Executive priority

Schedule remediation through normal kernel patch management unless local systems depend on bcache or affected Siemens products. There is no provided evidence of exploitation, but kernel memory-safety defects deserve timely closure because downstream impact can be hard to assess.

Technical view

In bcache, btree_iter was used both as a fixed stack allocation and as a dynamically sized mempool object. A fixed MAX_BSETS array could be indexed out of bounds for dynamically sized iterators, triggering UBSAN. The kernel fix changes the structure to use a flexible array member plus a separate stack wrapper.

Likely exposure

Exposure is most likely on Linux systems or embedded products running affected kernel lines with the bcache subsystem present and used. The bundle references Linux stable fixes and Siemens advisories, but does not enumerate specific downstream distributions, appliance models, or enabled-by-default exposure.

Exploitation context

The source bundle does not show active exploitation, KEV listing, public exploit code, or a CVSS score. It describes an out-of-bounds indexing condition detected by UBSAN. Practical exploitability and attacker prerequisites are not established in the provided evidence.

Researcher notes

Focus analysis on bcache btree_iter allocation paths and whether reachable workloads can create dynamically sized iterators beyond the old fixed array assumption. The bundle supports the bug class and fix direction, but not impact, privileges required, attack vector, or exploitability.

Mitigation direction

  • Apply the relevant Linux stable or vendor kernel update containing the bcache fix.
  • Check downstream distribution advisories for backported fixes and package versions.
  • Review referenced Siemens advisories if operating Siemens products with embedded Linux.
  • Prioritize systems using bcache for earlier maintenance windows.
  • Monitor vendor guidance because no standalone workaround is named in the bundle.

Validation and detection

  • Inventory kernels on systems that use or may load bcache.
  • Confirm installed kernel includes one of the referenced stable fix commits or downstream backport.
  • Check distribution security changelogs for CVE-2024-39482 coverage.
  • For appliances, compare model and firmware against vendor advisories.
  • Verify bcache usage before ranking local operational urgency.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-39482 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcafe563591446cf80bfbc2fe3bc72a2e36cf1060, cafe563591446cf80bfbc2fe3bc72a2e36cf1060, cafe563591446cf80bfbc2fe3bc72a2e36cf1060, cafe563591446cf80bfbc2fe3bc72a2e36cf1060, cafe563591446cf80bfbc2fe3bc72a2e36cf1060, cafe563591446cf80bfbc2fe3bc72a2e36cf1060unaffected
LinuxLinux3.10, 0, 5.10.221, 5.15.162, 6.1.94, 6.6.34, 6.9.5, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.