CVE-2024-46842 (GCVE-0-2024-46842)

Vulnerability from cvelistv5 – Published: 2024-09-27 12:39 – Updated: 2026-08-05 11:38
VLAI
Title
scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the routine unconditionally frees submitted mailbox commands regardless of return status. The issue is that for MBX_TIMEOUT cases, when firmware returns SFP information at a later time, that same mailbox memory region references previously freed memory in its cmpl routine. Fix by adding checks for the MBX_TIMEOUT return code. During mailbox resource cleanup, check the mbox flag to make sure that the wait did not timeout. If the MBOX_WAKE flag is not set, then do not free the resources because it will be freed when firmware completes the mailbox at a later time in its cmpl routine. Also, increase the timeout from 30 to 60 seconds to accommodate boot scripts requiring longer timeouts.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 479b0917e4477f49df2e3be454aac3cfa5dec171 , < bba47fe3b038cca3d3ebd799665ce69d6d273b58 (git)
Affected: 479b0917e4477f49df2e3be454aac3cfa5dec171 , < ede596b1434b57c0b3fd5c02b326efe5c54f6e48 (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:59:24.823160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:59:29.321Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_els.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bba47fe3b038cca3d3ebd799665ce69d6d273b58",
              "status": "affected",
              "version": "479b0917e4477f49df2e3be454aac3cfa5dec171",
              "versionType": "git"
            },
            {
              "lessThan": "ede596b1434b57c0b3fd5c02b326efe5c54f6e48",
              "status": "affected",
              "version": "479b0917e4477f49df2e3be454aac3cfa5dec171",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_els.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only path to the vulnerable function is a read of the sysfs attribute /sys/class/scsi_host/hostN/lpfc_xcvr_data, which requires local system access. The remote FC RDP ELS path uses the separate async lpfc_get_rdp_info() and is not affected.\nAC:L - The attacker creates the timeout condition themselves: the sysfs handler has no serialization or rate limiting, and all mailbox commands are drained serially from an unbounded FIFO, so many concurrent readers push individual waits past the 30-second window. Timeouts are demonstrably reachable in ordinary operation, as the fix itself raises the timeout to 60s for boot scripts.\nPR:L - The attribute is declared DEVICE_ATTR_RO (mode 0444) in the unconditional lpfc_hba_attrs[] group, so any local unprivileged account can read it with no capability check in lpfc_xcvr_data_show(). Only a basic local user account is needed.\nUI:N - The attacker performs the sysfs read themselves; no victim action or cooperation is required.\nS:U - The corruption is confined to kernel heap and driver structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed LPFC_MBOXQ_t and its DMA buffer are recycled while the HBA still writes SFP page data into them, and the stale completion path reads pointers and a function pointer out of reallocated memory, giving a use-after-free read primitive over arbitrary reclaimed kernel objects.\nI:H - The mbox is memset and re-issued while still on psli-\u003emboxq (list corruption), then double-freed via mempool_free plus lpfc_sli4_mbox_cmd_free on reclaimed memory, yielding arbitrary-pointer free and an indirect call through mbox_cmpl read from attacker-groomed heap \u2014 exploitable for control-flow hijack.\nA:H - The use-after-free, double free, and doubly-linked-list corruption of the mailbox queue reliably produce an oops or panic, and the attacker can repeat the sysfs read to retrigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:55.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58"
        },
        {
          "url": "https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"
        }
      ],
      "title": "scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46842",
    "datePublished": "2024-09-27T12:39:36.370Z",
    "dateReserved": "2024-09-11T15:12:18.289Z",
    "dateUpdated": "2026-08-05T11:38:55.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46842",
      "date": "2026-08-06",
      "epss": "0.00215",
      "percentile": "0.11961"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:47:50.000Z",
      "cve": "CVE-2024-46842",
      "id": "msrc_CVE-2024-46842",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:under_investigation": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46842.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46842\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-27T13:15:16.190\",\"lastModified\":\"2026-06-17T07:56:03.800\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\\n\\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\\nroutine unconditionally frees submitted mailbox commands regardless of\\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\\nreturns SFP information at a later time, that same mailbox memory region\\nreferences previously freed memory in its cmpl routine.\\n\\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\\nresource cleanup, check the mbox flag to make sure that the wait did not\\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\\nbecause it will be freed when firmware completes the mailbox at a later\\ntime in its cmpl routine.\\n\\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\\nscripts requiring longer timeouts.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Controlar los tiempos de espera del buz\u00f3n en lpfc_get_sfp_info El c\u00f3digo de retorno MBX_TIMEOUT no se maneja en lpfc_get_sfp_info y la rutina libera incondicionalmente los comandos de buz\u00f3n enviados independientemente del estado de retorno. El problema es que para los casos de MBX_TIMEOUT, cuando el firmware devuelve informaci\u00f3n SFP en un momento posterior, esa misma regi\u00f3n de memoria del buz\u00f3n hace referencia a la memoria liberada previamente en su rutina cmpl. Se soluciona agregando comprobaciones para el c\u00f3digo de retorno MBX_TIMEOUT. Durante la limpieza de recursos del buz\u00f3n, verifique el indicador mbox para asegurarse de que la espera no haya expirado. Si el indicador MBOX_WAKE no est\u00e1 configurado, no libere los recursos porque se liberar\u00e1n cuando el firmware complete el buz\u00f3n en un momento posterior en su rutina cmpl. Adem\u00e1s, aumente el tiempo de espera de 30 a 60 segundos para dar cabida a los scripts de arranque que requieren tiempos de espera m\u00e1s largos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/lpfc/lpfc_els.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"479b0917e4477f49df2e3be454aac3cfa5dec171\",\"lessThan\":\"bba47fe3b038cca3d3ebd799665ce69d6d273b58\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"479b0917e4477f49df2e3be454aac3cfa5dec171\",\"lessThan\":\"ede596b1434b57c0b3fd5c02b326efe5c54f6e48\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/lpfc/lpfc_els.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T13:59:24.823160Z\",\"id\":\"CVE-2024-46842\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"75C6119D-9E8D-431D-813F-FE84579072CB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:03:41+00:00",
      "cve": "CVE-2024-46842",
      "id": "CVE-2024-46842",
      "initial_release_date": "2024-09-27T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46842.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46842\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:59:24.823160Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:59:26.247Z\"}}], \"cna\": {\"title\": \"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"479b0917e4477f49df2e3be454aac3cfa5dec171\", \"lessThan\": \"bba47fe3b038cca3d3ebd799665ce69d6d273b58\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"479b0917e4477f49df2e3be454aac3cfa5dec171\", \"lessThan\": \"ede596b1434b57c0b3fd5c02b326efe5c54f6e48\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_els.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_els.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58\"}, {\"url\": \"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\\n\\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\\nroutine unconditionally frees submitted mailbox commands regardless of\\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\\nreturns SFP information at a later time, that same mailbox memory region\\nreferences previously freed memory in its cmpl routine.\\n\\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\\nresource cleanup, check the mbox flag to make sure that the wait did not\\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\\nbecause it will be freed when firmware completes the mailbox at a later\\ntime in its cmpl routine.\\n\\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\\nscripts requiring longer timeouts.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:37:35.917Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46842\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:37:35.917Z\", \"dateReserved\": \"2024-09-11T15:12:18.289Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:39:36.370Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.