CVE-2024-40901 scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
Out-of-bounds memory access in the mpt3sas SCSI driver allows attackers to cause memory corruption, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40901?
CVE-2024-40901 is a high-severity memory corruption vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions operate on long values, and when testing or setting a single word, they can exceed the word boundary. KASAN detects this issue and produces a dump:
BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas
Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965
For full log, please look at [1].
Make the allocation at least the size of sizeof(unsigned long) so that set_bit() and test_bit() have sufficient room for read/write operations without overwriting unallocated memory.
[1] Link: https://lore.kernel.org/all/[email protected]/
Weakness: CWE-787
Which versions are affected by CVE-2024-40901?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-40901?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-40901 being exploited?
There is no known exploitation of CVE-2024-40901 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-40901, DEBIAN-CVE-2024-40901, GHSA-m4m9-c6h9-vg2h, UBUNTU-CVE-2024-40901.