GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-57804 (GCVE-0-2024-57804)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:39 – Updated: 2026-08-05 11:46
VLAI
Title
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted. Use separate memory for each config request.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32d457d5a2af9bf5ddbe28297eabf1fc93451665 , < 869fdc6f0606060301aef648231e186c7c542f5a (git)
Affected: 32d457d5a2af9bf5ddbe28297eabf1fc93451665 , < 711201a8b8334a397440ac0b859df0054e174bc9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.12.8 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr.h",
            "drivers/scsi/mpi3mr/mpi3mr_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "869fdc6f0606060301aef648231e186c7c542f5a",
              "status": "affected",
              "version": "32d457d5a2af9bf5ddbe28297eabf1fc93451665",
              "versionType": "git"
            },
            {
              "lessThan": "711201a8b8334a397440ac0b859df0054e174bc9",
              "status": "affected",
              "version": "32d457d5a2af9bf5ddbe28297eabf1fc93451665",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr.h",
            "drivers/scsi/mpi3mr/mpi3mr_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs\n\nThe driver, through the SAS transport, exposes a sysfs interface to\nenable/disable PHYs in a controller/expander setup.  When multiple PHYs\nare disabled and enabled in rapid succession, the persistent and current\nconfig pages related to SAS IO unit/SAS Expander pages could get\ncorrupted.\n\nUse separate memory for each config request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local sysfs attributes under /sys/class/sas_phy/ (phy error counters, enable, link rate) and the bsg device; there is no network-facing path into mpi3mr config-page processing.\nAC:L - The attacker controls both sides of the race by concurrently reading the world-readable phy error-counter attributes across multiple phys/threads, each of which memsets and reuses the shared mrioc-\u003ecfg_page outside cfg_cmds.mutex; the commit itself notes the corruption occurs on operations \"in rapid succession\", with no attacker-uncontrollable precondition.\nPR:L - The SAS transport exports invalid_dword_count, running_disparity_error_count, loss_of_dword_sync_count and phy_reset_problem_count with S_IRUGO (0444), and reading them invokes mpi3mr_transport_get_linkerrors() -\u003e mpi3mr_cfg_get_sas_phy_pg1() -\u003e mpi3mr_process_cfg_req(), so an unprivileged local user can drive the racy shared-buffer path and corrupt config requests issued by any other context, including a privileged WRITE_PERSISTENT.\nUI:N - The attacker\u0027s own concurrent sysfs reads race each other and race the driver\u0027s internal discovery/reset config-page reads; no victim action is required to trigger the corruption.\nS:U - The corrupted state is the HBA driver\u0027s DMA buffer and the controller configuration it manages, all within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - A thread\u0027s post-mutex read-out memcpy can return a different config page\u0027s contents (device SAS addresses/WWNs, enclosure identifiers, expander topology, driver page settings), which are then surfaced to unprivileged userspace through the world-readable phy sysfs attributes; the leak is bounded to the 1024-byte shared config buffer rather than arbitrary kernel memory.\nI:H - mpi3mr_cfg_set_sas_io_unit_pg1() performs WRITE_CURRENT and WRITE_PERSISTENT with a payload staged in the unlocked shared buffer, so a racing reader causes zeroed/foreign data to be DMA\u0027d into the controller\u0027s non-volatile SAS IO Unit / SAS Expander configuration, and garbled reads poison the driver\u0027s SAS topology state (device handles, SAS addresses, port IDs) used for I/O routing \u2014 a direct and serious integrity loss.\nA:H - A corrupted persistent SAS IO Unit Page 1 leaves PHYs disabled or with invalid link rates, so storage behind the HBA fails to come back and the misconfiguration survives reboot; additionally a botched config request drives mpi3mr_check_rh_fault_ioc(MPI3MR_RESET_FROM_CFG_REQ_TIMEOUT), diag-faulting and resetting the controller and potentially marking it unrecoverable, stalling all attached I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:37.980Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/869fdc6f0606060301aef648231e186c7c542f5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/711201a8b8334a397440ac0b859df0054e174bc9"
        }
      ],
      "title": "scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57804",
    "datePublished": "2025-01-11T12:39:50.958Z",
    "dateReserved": "2025-01-09T09:50:31.793Z",
    "dateUpdated": "2026-08-05T11:46:37.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57804",
      "date": "2026-09-16",
      "epss": "0.00184",
      "percentile": "0.08223"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs\\n\\nThe driver, through the SAS transport, exposes a sysfs interface to\\nenable/disable PHYs in a controller/expander setup.  When multiple PHYs\\nare disabled and enabled in rapid succession, the persistent and current\\nconfig pages related to SAS IO unit/SAS Expander pages could get\\ncorrupted.\\n\\nUse separate memory for each config request.\"}]",
      "id": "CVE-2024-57804",
      "lastModified": "2025-01-11T13:15:30.233",
      "published": "2025-01-11T13:15:30.233",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/711201a8b8334a397440ac0b859df0054e174bc9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/869fdc6f0606060301aef648231e186c7c542f5a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:54:08.000Z",
      "cve": "CVE-2024-57804",
      "id": "msrc_CVE-2024-57804",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:under_investigation": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57804.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57804\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:30.233\",\"lastModified\":\"2026-08-04T11:22:28.613\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs\\n\\nThe driver, through the SAS transport, exposes a sysfs interface to\\nenable/disable PHYs in a controller/expander setup.  When multiple PHYs\\nare disabled and enabled in rapid succession, the persistent and current\\nconfig pages related to SAS IO unit/SAS Expander pages could get\\ncorrupted.\\n\\nUse separate memory for each config request.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: mpi3mr: Se corrige el estado de PHY de las p\u00e1ginas de configuraci\u00f3n corruptas en sysfs El controlador, a trav\u00e9s del transporte SAS, expone una interfaz sysfs para habilitar o deshabilitar los PHY en una configuraci\u00f3n de controlador o expansor. Cuando se deshabilitan y habilitan varios PHY en r\u00e1pida sucesi\u00f3n, las p\u00e1ginas de configuraci\u00f3n persistentes y actuales relacionadas con la unidad SAS IO o las p\u00e1ginas del expansor SAS podr\u00edan corromperse. Utilice una memoria independiente para cada solicitud de configuraci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/mpi3mr/mpi3mr.h\",\"drivers/scsi/mpi3mr/mpi3mr_fw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"32d457d5a2af9bf5ddbe28297eabf1fc93451665\",\"lessThan\":\"869fdc6f0606060301aef648231e186c7c542f5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32d457d5a2af9bf5ddbe28297eabf1fc93451665\",\"lessThan\":\"711201a8b8334a397440ac0b859df0054e174bc9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/mpi3mr/mpi3mr.h\",\"drivers/scsi/mpi3mr/mpi3mr_fw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.8\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.12.8\",\"matchCriteriaId\":\"11D6C799-E58B-46D0-BA4A-28D13E7F6B94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/711201a8b8334a397440ac0b859df0054e174bc9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/869fdc6f0606060301aef648231e186c7c542f5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:39:53+00:00",
      "cve": "CVE-2024-57804",
      "id": "CVE-2024-57804",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57804.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:21:33Z",
      "cve": "CVE-2024-57804",
      "id": "CVE-2024-57804",
      "initial_release_date": "2025-01-12T00:14:09Z",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "428",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57804",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57804.json",
      "version": "67"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.