CVE-2024-57804: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted.
Use separate memory for each config request.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57804?
CVE-2024-57804 is categorized as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-57804?
To fix CVE-2024-57804, ensure that you update your Linux kernel to the latest stable release that contains the patch.
What component of the Linux kernel is affected by CVE-2024-57804?
CVE-2024-57804 affects the SCSI MPI3MR driver within the Linux kernel.
What type of vulnerability is CVE-2024-57804?
CVE-2024-57804 is a vulnerability related to the sysfs interface for enabling and disabling PHYs in a controller/expander setup.
Does CVE-2024-57804 require immediate attention?
While CVE-2024-57804 has a low severity rating, it is advisable to apply the patch to maintain system integrity.