CVE-2024-24855

What it actually does

Race condition in lpfc_unregister_fcf_rescan() within the Linux kernel SCSI driver allows a null pointer dereference, resulting in kernel panic or denial of service.

Why it matters to the business

Affected systems risk sudden crashes and service unavailability; low EPSS with no KEV or ransomware usage reduces immediate urgency despite 982 days since publication.

How an attack unfolds

A local attacker triggers concurrent calls to the vulnerable SCSI function to induce the race condition and null pointer dereference, potentially crashing the kernel; listed threat actors relate to similar kernel issues but no direct exploitation reported here.

How to fix it

Update affected openproject GIT instances to the fixed commit d06d1b69602fdcc2a3cfd0ec58ac5b5271c16b20.

How to confirm the fix worked

Verify kernel builds or package versions contain the referenced commit; test for absence of the race condition under concurrent SCSI FCF rescan workloads.

Typical attack path

1. Obtain local user access on the target system
2. Trigger concurrent invocations of lpfc_unregister_fcf_rescan()
3. Induce null pointer dereference to cause kernel panic

How to detect it

Review kernel logs for null pointer dereference oops involving lpfc_unregister_fcf_rescan; check for unexpected panics on systems with Emulex Fibre Channel adapters.

What your security team should do

• Prioritize patching systems running the affected SCSI driver code
• Monitor for kernel oops/panic logs related to lpfc
• Apply the listed commit across all openproject GIT deployments