CVE-2024-46842

What it actually does

Use-after-free in lpfc_get_sfp_info where MBX_TIMEOUT causes unconditional freeing of mailbox memory that the firmware completion routine later references, creating a dangling pointer in the SCSI lpfc driver.

Why it matters to the business

Kernel instability or crashes on systems using Emulex Fibre Channel adapters, with potential for local privilege escalation; affects Linux distributions and downstream dependents in storage and virtualization environments, increasing operational risk until patched.

How an attack unfolds

An attacker triggers a mailbox timeout in lpfc_get_sfp_info through timing manipulation or firmware interaction, causing premature resource release; later firmware completion then accesses the freed memory, enabling use-after-free exploitation for kernel code execution or denial of service.

How to fix it

Update the Linux kernel to include commit bba47fe3b038cca3d3ebd799665ce69d6d273b58 which adds MBX_TIMEOUT checks, mbox flag validation, and raises timeout to 60 seconds; also apply stdlib (Go) update to 1.13.13 where listed.

How to confirm the fix worked

Verify kernel source or package includes the referenced commit, confirm lpfc mailbox handling checks for MBX_TIMEOUT and MBOX_WAKE flag, and test SFP info retrieval under delayed firmware response conditions.

Typical attack path

1. Identify system with lpfc driver and Fibre Channel hardware
2. Trigger conditions leading to MBX_TIMEOUT in lpfc_get_sfp_info
3. Allow firmware to complete the mailbox after resource free
4. Exploit resulting use-after-free for memory corruption or control flow hijack

How to detect it

Search kernel logs and dmesg for lpfc mailbox timeout messages, MBX_TIMEOUT return codes, and use-after-free related panics or warnings in the lpfc driver; examine crash dumps for references to freed mailbox structures during SFP info operations.

• MBX_TIMEOUT
• lpfc_get_sfp_info
• MBOX_WAKE

What your security team should do

• Apply the kernel patch containing bba47fe3b038cca3d3ebd799665ce69d6d273b58 immediately on affected systems
• Prioritize updates for storage and SAN-connected hosts due to lpfc exposure
• Monitor for kernel oops or panic logs related to lpfc mailbox handling
• Review boot scripts and increase any custom lpfc timeouts as interim measure