CVE-2024-42159

What it actually does

The mpi3mr driver fails to validate num_phys before storing it into mr_sas_port->phy_mask, allowing an out-of-bounds write or subsequent invalid memory access when a value larger than the mask field size is supplied.

Why it matters to the business

Local attackers on Linux systems using affected Broadcom/Avago MPI3MR controllers can achieve kernel-level code execution, resulting in full host compromise, data theft, or denial of service; the issue affects a widely deployed kernel component used in enterprise storage.

How an attack unfolds

An attacker with local access supplies a crafted num_phys value through the SCSI/MPI3MR interface; the unsanitized value is written into the phy_mask field, corrupting adjacent kernel memory structures and enabling privilege escalation or arbitrary code execution.

How to fix it

Upgrade the Linux kernel to the commit b869ec89d2ee923d46608b76e54c006680c9b4df or later stable releases that include the sanitization of num_phys in the mpi3mr driver; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the presence of the sanitization check for num_phys against the size of phy_mask in the mpi3mr source; verify the running kernel contains commit b869ec89d2ee923d46608b76e54c006680c9b4df via uname or kernel build logs.

Typical attack path

1. Obtain local shell on target Linux host with access to MPI3MR storage controller
2. Trigger the driver path that accepts and stores num_phys without bounds checking
3. Supply oversized value that overflows mr_sas_port->phy_mask
4. Leverage resulting memory corruption for kernel read/write or code execution
5. Escalate to root and establish persistence or exfiltrate data

How to detect it

Inspect kernel logs and audit records for unexpected mpi3mr driver errors or oops reports around phy_mask handling; correlate with process execution of tools that interact with SCSI storage devices.

What your security team should do

• Immediately schedule kernel updates for all systems exposing MPI3MR hardware
• Restrict local user access on storage servers until patches are applied
• Monitor for new kernel releases and test the fixed version in staging environments
• Review any custom kernel modules or drivers that interact with mpi3mr for similar validation issues