CVE-2021-47565

What it actually does

Use-after-free in the mpt3sas SCSI driver allows access to a freed sas_target structure while iterating the shost sdev list, dereferencing the sas_address field without a NULL check and triggering a kernel panic.

Why it matters to the business

Systems using affected MPT3SAS controllers may experience unexpected kernel crashes during drive removal or power-cycle events, leading to downtime and potential data inaccessibility on Linux servers and storage appliances.

How an attack unfolds

An attacker with local access or the ability to trigger drive removal events (for example via power-cycle hardware manipulation or privileged commands) can force the race condition where sas_target is freed while the sdev reference remains, causing the driver to read from freed memory and panic the kernel.

How to fix it

Update to a Linux kernel containing the fix for this use-after-free in the mpt3sas driver; apply the latest stable kernel or distribution backport that resolves the sas_target NULL check.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds the sas_target NULL check before accessing sas_address; verify by inspecting the mpt3sas driver source or running a drive power-cycle test without observing a panic.

Typical attack path

1. Obtain local or privileged access to a system with mpt3sas hardware
2. Trigger repeated drive power-cycle or hot-remove events
3. Force iteration over the sdev list while sas_target is concurrently freed
4. Induce NULL dereference on sas_address leading to kernel panic

How to detect it

Review kernel logs for mpt3sas-related oops or panic messages referencing sas_target or sas_address during drive removal events; correlate with hardware event timestamps.

What your security team should do

• Prioritize kernel updates on any systems using MPT3SAS controllers
• Monitor for kernel oops or panic logs related to mpt3sas during storage events
• Apply the fix even on non-production systems given the age of the issue