CVE-2022-48791

What it actually does

Use-after-free in the pm8001 SCSI driver: when a TMF sas_task times out, pm8001_exec_internal_tmf_task() frees the task after setting SAS_TASK_STATE_ABORTED, yet a later mpi_ssp_completion() still dereferences the now-invalid ccb->task pointer.

Why it matters to the business

Systems using certain SAS HBAs can experience kernel crashes, memory corruption, or local privilege escalation, leading to unplanned downtime and potential full host compromise on unpatched Linux kernels.

How an attack unfolds

An attacker with local access triggers SCSI I/O that causes a TMF timeout; the race between task free and subsequent completion handler allows the freed sas_task to be accessed, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.102 or apply commit d872e7b5fe38f325f5206b6872746fa02c2b4819 (and equivalent backports) in the pm8001 driver; reboot after installation.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking /proc/version or the source tree for the clearing of ccb->task on TMF timeout; attempt to reproduce the original timeout+completion sequence under test workloads to verify no crash occurs.

Typical attack path

1. Obtain local shell on target Linux host with pm8001 hardware
2. Issue SCSI commands that induce a task management function timeout
3. Race the I/O completion path against the freed sas_task
4. Use resulting UAF to corrupt kernel memory and escalate privileges

How to detect it

Review kernel logs for pm8001-related oops or use-after-free warnings around SCSI timeout handling; correlate with process activity that issues task management functions on SAS devices.

What your security team should do

• Prioritize kernel updates on all systems exposing the pm8001 driver within the next patching cycle
• Restrict local user access on hosts using affected SAS controllers until patched
• Monitor vendor advisories for additional stable-branch backports