Linux kernel scsi/mpi3mr: uninitialized event-ack array causes out-of-bounds bitmap clear and UAF

Impact

The mpi3mr driver for Broadcom tri-mode storage controllers never initialized its evtack_cmds array, so the zero host_tag is used as a bit index into evtack_cmds_bitmap and clear_bit() touches memory outside the allocation - observed as a KASAN use-after-free. The trigger reported is a controller firmware update (eHBA-9600 to 8.3.1.0), not an attacker action, so this reads as a stability defect on nodes with these HBAs behind local NVMe or SAS storage. A crash here takes the storage path down with the node.

Who can reach it

No attacker is involved in the reported path. It occurs during normal operation of a host with an mpi3mr-driven controller, specifically around event acknowledgement after a controller firmware update. Physical or administrative access to the host is implicit.

What to do

Update to a stable kernel containing the evtack_cmds initialization fix (commits 4e0dfdb48a82, 67989091e11a, e39ea831ebad) and reboot the node. If a controller firmware update is planned on an unpatched host, patch the kernel first - the record ties the crash to that update.

References

Related entries

• Linux kernel mlx5: SKB leak during PTP FIFO resync exhausts memory on ConnectX NICsCVE-2023-54238 · Linux kernel mlx5 driver (PTP SKB FIFO resync)High
• Linux kernel mlxsw (Spectrum switch ASIC ACL TCAM): On Spectrum-2 and newer, firmware reports more than 16 ACLs perCVE-2024-26586 · Linux kernel mlxsw (Spectrum switch ASIC ACL TCAM)High
• Linux kernel (drivers/infiniband/hw/hfi1): An off-by-one in the SDMA descriptor accounting lets the descriptor array inCVE-2024-26766 · Linux kernel (drivers/infiniband/hw/hfi1)High
• AMI AptioV UEFI BIOS (SmmComputrace DXE module): The SmmComputrace DXE module leaks stack and global memory to a localCVE-2024-33656 · AMI AptioV UEFI BIOS (SmmComputrace DXE module)High
• AMI AptioV UEFI BIOS (SMM modules): An SMM vulnerability letting a privileged local attacker execute arbitrary codeCVE-2024-33657 · AMI AptioV UEFI BIOS (SMM modules)High
• AMI AptioV BIOS (memory buffer restriction failure): Local privilege escalation and potentially arbitrary codeCVE-2024-33658 · AMI AptioV BIOS (memory buffer restriction failure)High