Cloudanix VulnDB

CVE-2023-54234

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing setup step in a Linux storage driver can crash the whole system or allow an attacker with local access to take control when certain hardware firmware is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing initialization of the evtack_cmds array in the mpi3mr SCSI driver leaves host_tag fields zeroed, causing mpi3mr_complete_evt_ack to invoke clear_bit on evtack_cmds_bitmap with an invalid index and resulting in KASAN-detected use-after-free during certain firmware operations.

Why it matters to the business

Systems using the affected Broadcom/Avago eHBA-9600 adapters may experience kernel crashes or memory corruption when updating to firmware 8.3.1.0, leading to unplanned downtime and potential data loss until kernels containing the fix are deployed.

How an attack unfolds

An attacker with local access triggers the mpi3mr event-acknowledgment path by initiating a supported firmware update on vulnerable hardware; the uninitialized array elements cause an out-of-bounds clear_bit that accesses freed memory, manifesting as a use-after-free that can be leveraged for further kernel exploitation.

How to fix it

Update the Linux kernel to a version containing commit 4e0dfdb48a824deac3dfbc67fb856ef2aee13529 or later; rebuild and reboot with the corrected mpi3mr driver initialization.

How to confirm the fix worked

Confirm the running kernel contains commit 4e0dfdb48a824deac3dfbc67fb856ef2aee13529, verify that mrioc->evtack_cmds elements are properly initialized before any firmware update, and re-test the eHBA-9600 firmware update procedure without triggering KASAN reports.

Typical attack path

  1. Obtain local root or sufficient privileges on a system with mpi3mr hardware
  2. Trigger the firmware-update code path that exercises mpi3mr_complete_evt_ack
  3. Trigger the use-after-free via the zeroed host_tag and invalid bitmap clear
  4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for KASAN use-after-free reports mentioning mpi3mr_complete_evt_ack or evtack_cmds_bitmap around the time of eHBA-9600 firmware updates; examine crash dumps for invalid clear_bit operations on the evtack_cmds structure.

What your security team should do

  • Prioritize kernel updates containing the referenced commit on all systems with mpi3mr adapters
  • Schedule firmware updates only after the kernel fix is applied
  • Add the affected commit hash to internal kernel build and deployment pipelines
  • Monitor for future mpi3mr-related patches in stable trees

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.17.0 6.1.16
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.118.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.118.1

Related vulnerabilities