CVE-2024-40901

What it actually does

Out-of-bounds memory write when test_bit/set_bit operate on a single word allocation smaller than sizeof(unsigned long) in mpt3sas_scsih.c, detected as slab-out-of-bounds by KASAN.

Why it matters to the business

Kernel memory corruption on Linux systems using MPT3SAS controllers can cause crashes, data corruption, or potential privilege escalation; widespread in server and storage environments with high downstream kernel dependents.

How an attack unfolds

An attacker with local access or via malicious hardware/firmware interaction triggers _scsih_add_device to perform bit operations on undersized allocation; listed threat actors in 2024 zero-day and Linux kernel campaigns could weaponize the resulting out-of-bounds write for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to commit e9bce7c751f6d6c7be88c0bc081a66aaf61a23ee or later stable releases containing the fix that ensures allocation is at least sizeof(unsigned long).

How to confirm the fix worked

Confirm kernel version contains e9bce7c751f6d6c7be88c0bc081a66aaf61a23ee; recompile with KASAN and exercise mpt3sas device addition paths to verify absence of slab-out-of-bounds reports.

Typical attack path

1. Gain local execution or control a device that causes mpt3sas device addition
2. Trigger _scsih_add_device path that calls test_bit/set_bit on single-word allocation
3. Induce slab-out-of-bounds write via bit operation exceeding word boundary
4. Leverage memory corruption for privilege escalation or kernel panic

How to detect it

Review kernel logs for KASAN slab-out-of-bounds dumps referencing mpt3sas_scsih.c and bitops.h during device enumeration; inspect for unexpected kworker activity or mpt3sas crashes in systems exposed to listed threat actor tactics.

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems given 823 days since publication
• Prioritize patching servers with MPT3SAS hardware due to high ecosystem prevalence
• Monitor for any new exploit maturity indicators despite current low EPSS