CVE-2022-48695

What it actually does

Use-after-free in the mpt3sas SCSI driver caused by refcount underflow during controller reset operations in the Linux kernel.

Why it matters to the business

Systems using affected Linux kernels with mpt3sas hardware may experience crashes, storage instability, or denial of service during routine controller resets, impacting server availability and data access.

How an attack unfolds

An attacker triggers a controller reset in the mpt3sas driver, causing the refcount underflow that manifests as a use-after-free condition; this can be leveraged for memory corruption leading to crashes or further exploitation.

How to fix it

Update the Linux kernel to a version containing commit b8fc9e91b931215110ba824d1a2983c5f60b6f82 or later stable releases that resolve the refcount handling in mpt3sas.

How to confirm the fix worked

Confirm the presence of the fix commit in kernel sources, verify updated kernel packages are installed, and test controller reset behavior to ensure no refcount warnings occur.

Typical attack path

1. Gain local access or ability to induce hardware events on a Linux system with mpt3sas
2. Trigger a controller reset condition
3. Exploit the resulting refcount underflow to trigger use-after-free
4. Leverage memory corruption for denial of service or potential escalation

How to detect it

Inspect kernel logs for refcount underflow warnings mentioning mpt3sas or lib/refcount.c during controller reset events; correlate with system uptime and hardware reset logs.

What your security team should do

• Prioritize kernel updates for systems using mpt3sas controllers
• Review and apply stable kernel releases containing the referenced commit
• Monitor kernel logs for refcount warnings during hardware events
• Test updates in non-production environments before broad deployment