CVE-2024-49891

What it actually does

NULL pointer dereference in lpfc driver routines (lpfc_sli_flush_io_rings, lpfc_dev_loss_tmo_callbk, lpfc_abort_handler) when hdwq pointers are freed during concurrent HBA reset or errata events, resulting in kernel crashes.

Why it matters to the business

Unexpected system crashes and downtime on servers using lpfc HBAs, especially during maintenance or error recovery operations, increasing operational risk for storage-dependent workloads.

How an attack unfolds

An attacker with local access triggers or waits for an HBA reset/errata event to collide with active IO paths, causing the driver to dereference freed hdwq pointers and crash the kernel; listed threat actors have targeted similar kernel memory issues in Linux.

How to fix it

Apply the upstream kernel fix adding NULL pointer validation before hdwq dereferences in reset and errata paths; for Rocky Linux 8 environments update the listed Python packages to the specified fixed versions where applicable and rebuild or reboot as needed.

How to confirm the fix worked

Inspect kernel source or running driver for added NULL checks in lpfc_sli_flush_io_rings, lpfc_dev_loss_tmo_callbk and lpfc_abort_handler; confirm no crashes occur during simulated reset/errata scenarios.

Typical attack path

1. Obtain local code execution or physical access to trigger HBA events
2. Initiate storage IO operations via the lpfc driver
3. Force or wait for reset/errata handling to overlap with pointer use
4. Trigger NULL dereference to induce kernel panic or denial of service

How to detect it

Search kernel logs, dmesg, and system crash dumps for references to lpfc_sli_flush_io_rings, lpfc_dev_loss_tmo_callbk, lpfc_abort_handler combined with NULL pointer or reset events; correlate with timestamps of HBA resets.

• lpfc_sli_flush_io_rings
• lpfc_dev_loss_tmo_callbk
• lpfc_abort_handler
• NULL ptr dereference.*hdwq

What your security team should do

• Prioritize patching systems with lpfc HBAs due to memory corruption risk
• Monitor kernel logs for oops/panics referencing lpfc reset paths
• Test updates in staging before broad deployment given low EPSS but kernel impact
• Review downstream package dependencies for Rocky Linux 8 environments