CVE-2024-42288

What it actually does

Incorrect dereference of the Init Control Block (ICB) in the qla2xxx SCSI driver leads to memory corruption within the Linux kernel.

Why it matters to the business

Organizations running affected Linux kernels on systems with QLogic Fibre Channel adapters face elevated risk of kernel instability, crashes, or potential code execution, especially given the kernel's presence in 144953 downstream dependents; the issue is not known to be under active exploitation or tied to ransomware.

How an attack unfolds

An attacker with local access crafts input that triggers the faulty ICB dereference path in the qla2xxx driver, resulting in memory corruption that can be leveraged for privilege escalation or denial of service; listed threat actor campaigns reference generic Linux kernel memory issues but no confirmed exploitation of this specific flaw has been observed.

How to fix it

Update the Linux kernel to a version containing commit dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb or later; for any npm braces dependency, ensure version 3.0.3 or newer is used. Reboot systems after applying kernel updates and verify the driver is no longer vulnerable.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, check driver source for correct ICB dereferencing, and test storage initialization under load to ensure no memory faults occur.

Typical attack path

1. Gain local access to a system using the vulnerable qla2xxx driver
2. Trigger the SCSI control block initialization path with malformed or unexpected parameters
3. Exploit the resulting memory corruption for arbitrary read/write or control flow hijacking
4. Escalate privileges or disrupt storage operations

How to detect it

Review kernel logs for qla2xxx driver faults or memory corruption warnings around SCSI initialization; inspect for unusual process crashes or storage stack errors post boot; correlate with any local privilege escalation attempts in audit logs.

What your security team should do

• Prioritize kernel updates on all systems exposing QLogic adapters within the next patching cycle
• Monitor EPSS and KEV status for any future increase in exploit activity
• Restrict local access on high-value systems until patches are applied