CVE-2024-57804 scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
A race condition in the mpi3mr driver allows corrupting config pages when PHYs are rapidly toggled via sysfs, potentially leading to data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57804?
CVE-2024-57804 is a high-severity vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted.
Use separate memory for each config request.
Which versions are affected by CVE-2024-57804?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-57804?
Apply the vendor's patch.
Is CVE-2024-57804 being exploited?
There is no known exploitation of CVE-2024-57804 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62684, BELL-CVE-2024-57804, DEBIAN-CVE-2024-57804, GHSA-q94p-cf39-j6hv, ROOT-OS-DEBIAN-12-CVE-2024-57804, ROOT-OS-UBUNTU-2204-CVE-2024-57804 and 1 more.