Executive brief
The Linux kernel's mpi3mr SCSI controller driver contains a memory safety bug in its event acknowledgment handler. When processing device events, uninitialized data structures cause the kernel to access invalid memory addresses, triggering a crash. This affects servers and storage systems using compatible SCSI hardware controllers, potentially causing unexpected reboots or denial of service during firmware updates or normal operation.
Technical details
The vulnerability is a use-after-free memory access bug in the mpi3mr SCSI driver's event acknowledgment logic (drivers/scsi/mpi3mr/mpi3mr_os.c). Commit c1af985d27da introduced an array `mrioc->evtack_cmds` but failed to initialize its elements. The `mpi3mr_complete_evt_ack()` function reads the uninitialized `host_tag` field (value 0) from these elements and passes it as a bitmap index to `clear_bit()`, causing access to an out-of-bounds memory address. The bug manifests as "BUG: KASAN: use-after-free" and was observed during eHBA-9600 firmware updates to version 8.3.1.0. The fix adds initialization of array elements with proper host tag values via a loop calling `mpi3mr_init_drv_cmd()`. Patches are available in kernel stable trees.
Affected products
- Linux Linux kernel Linux kernel versions from the introduction of commit c1af985d27da (affecting multiple stable branches including 4.19.y, 5.x.y, 6.x.y)
Timeline
- 2023-02-14: other: Vulnerability fix committed upstream
- 2023-03-10: patched: Fix merged into stable kernel branches