CVE-2023-54234

Root

Cause

In the Linux kernel's mpi3mr SCSI driver, commit c1af985d27da introduced an array mrioc->evtack_cmds for event acknowledgment logic, but the initialization of its elements was omitted. The array was only zero-cleared, leaving the host_tag field of each element as zero. This oversight causes mpi3mr_complete_evt_ack() to use a wrong bit index when calling clear_bit() on mrico->evtack_cmds_bitmap, leading to memory corruption [1].

Exploitation

The vulnerability manifests during a firmware update of eHBA-9600 controllers to version 8.3.1.0. No special privileges or network access are required beyond the ability to trigger a firmware update on an affected system. The bug is triggered in the normal driver operation path when event acknowledgments are processed, making it reachable without explicit attacker interaction [1].

Impact

Successful exploitation results in a use-after-free condition, as reported by KASAN (Kernel Address Sanitizer). This can lead to system instability, denial of service, or potentially arbitrary code execution in kernel context, depending on memory layout and attacker control over the freed memory [1].

Mitigation

The fix adds the missing initialization of mrioc->evtack_cmds elements. The patch is available in the stable kernel tree and should be applied to any kernel version containing the vulnerable commit [1].