CVE-2022-48792

What it actually does

Use-after-free in the pm8001 SCSI driver where an aborted sas_task is freed by the upper layer upon calling complete() but is then accessed in pm8001_ccb_task_free() during I/O completion handling in mpi_ssp_completion or mpi_sata_completion.

Why it matters to the business

Linux systems using the pm8001 driver face risk of kernel crashes, memory corruption, or potential local privilege escalation, affecting storage reliability and server uptime in affected environments.

How an attack unfolds

An attacker with local access triggers task aborts on SSP/STP operations, forcing the upper layer to free the sas_task after complete() while the driver's subsequent pm8001_ccb_task_free() still references the freed structure, leading to use-after-free.

How to fix it

Update the Linux kernel to the fixed commit fe9ac3eaa2e387a5742b380b73a5a6bc237bf184 or later stable releases containing the reordered complete() and pm8001_ccb_task_free() calls.

How to confirm the fix worked

Verify kernel source contains the commit fe9ac3eaa2e387a5742b380b73a5a6bc237bf184 or boot a patched kernel and confirm no use-after-free in pm8001 completion paths via code review or targeted testing.

Typical attack path

1. Obtain local access on a system using pm8001 hardware
2. Issue or manipulate SAS/SCSI I/O operations that can be aborted
3. Force abort of sas_task before completion handling
4. Trigger mpi_ssp_completion or mpi_sata_completion paths
5. Exploit freed memory access for corruption or control flow hijack

How to detect it

Review kernel logs and crash dumps for use-after-free reports involving pm8001_ccb_task_free or sas_task structures; monitor for unexpected panics during SCSI I/O abort scenarios.

What your security team should do

• Apply the kernel patch upgrading to the fixed commit immediately on all systems using pm8001
• Prioritize patching for production storage servers due to local privilege escalation potential
• Monitor kernel update channels for backports to supported distributions
• Restrict untrusted local access until patches are deployed