CVE-2024-46842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-46842", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.289Z", "datePublished": "2024-09-27T12:39:36.370Z", "dateUpdated": "2026-10-21T12:35:15.471Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:15.471Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status. The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code. During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout. If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only path to the vulnerable function is a read of the sysfs attribute /sys/class/scsi_host/hostN/lpfc_xcvr_data, which requires local system access. The remote FC RDP ELS path uses the separate async lpfc_get_rdp_info() and is not affected.\nAC:L - The attacker creates the timeout condition themselves: the sysfs handler has no serialization or rate limiting, and all mailbox commands are drained serially from an unbounded FIFO, so many concurrent readers push individual waits past the 30-second window. Timeouts are demonstrably reachable in ordinary operation, as the fix itself raises the timeout to 60s for boot scripts.\nPR:L - The attribute is declared DEVICE_ATTR_RO (mode 0444) in the unconditional lpfc_hba_attrs[] group, so any local unprivileged account can read it with no capability check in lpfc_xcvr_data_show(). Only a basic local user account is needed.\nUI:N - The attacker performs the sysfs read themselves; no victim action or cooperation is required.\nS:U - The corruption is confined to kernel heap and driver structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed LPFC_MBOXQ_t and its DMA buffer are recycled while the HBA still writes SFP page data into them, and the stale completion path reads pointers and a function pointer out of reallocated memory, giving a use-after-free read primitive over arbitrary reclaimed kernel objects.\nI:H - The mbox is memset and re-issued while still on psli->mboxq (list corruption), then double-freed via mempool_free plus lpfc_sli4_mbox_cmd_free on reclaimed memory, yielding arbitrary-pointer free and an indirect call through mbox_cmpl read from attacker-groomed heap \u2014 exploitable for control-flow hijack.\nA:H - The use-after-free, double free, and doubly-linked-list corruption of the mailbox queue reliably produce an oops or panic, and the attacker can repeat the sysfs read to retrigger it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "versions": [{"version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "c6d8cce685d6088d795b29a0f47e6fd04548fd64", "status": "affected", "versionType": "git"}, {"version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "bba47fe3b038cca3d3ebd799665ce69d6d273b58", "status": "affected", "versionType": "git"}, {"version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "ede596b1434b57c0b3fd5c02b326efe5c54f6e48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64"}, {"url": "https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58"}, {"url": "https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}], "title": "scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-29T13:59:24.823160Z", "id": "CVE-2024-46842", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:59:29.321Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-29T13:59:24.823160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:59:26.247Z"}}], "cna": {"title": "scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only path to the vulnerable function is a read of the sysfs attribute /sys/class/scsi_host/hostN/lpfc_xcvr_data, which requires local system access. The remote FC RDP ELS path uses the separate async lpfc_get_rdp_info() and is not affected.\nAC:L - The attacker creates the timeout condition themselves: the sysfs handler has no serialization or rate limiting, and all mailbox commands are drained serially from an unbounded FIFO, so many concurrent readers push individual waits past the 30-second window. Timeouts are demonstrably reachable in ordinary operation, as the fix itself raises the timeout to 60s for boot scripts.\nPR:L - The attribute is declared DEVICE_ATTR_RO (mode 0444) in the unconditional lpfc_hba_attrs[] group, so any local unprivileged account can read it with no capability check in lpfc_xcvr_data_show(). Only a basic local user account is needed.\nUI:N - The attacker performs the sysfs read themselves; no victim action or cooperation is required.\nS:U - The corruption is confined to kernel heap and driver structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed LPFC_MBOXQ_t and its DMA buffer are recycled while the HBA still writes SFP page data into them, and the stale completion path reads pointers and a function pointer out of reallocated memory, giving a use-after-free read primitive over arbitrary reclaimed kernel objects.\nI:H - The mbox is memset and re-issued while still on psli->mboxq (list corruption), then double-freed via mempool_free plus lpfc_sli4_mbox_cmd_free on reclaimed memory, yielding arbitrary-pointer free and an indirect call through mbox_cmpl read from attacker-groomed heap \u2014 exploitable for control-flow hijack.\nA:H - The use-after-free, double free, and doubly-linked-list corruption of the mailbox queue reliably produce an oops or panic, and the attacker can repeat the sysfs read to retrigger it at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "c6d8cce685d6088d795b29a0f47e6fd04548fd64", "versionType": "git"}, {"status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "bba47fe3b038cca3d3ebd799665ce69d6d273b58", "versionType": "git"}, {"status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "lessThan": "ede596b1434b57c0b3fd5c02b326efe5c54f6e48", "versionType": "git"}], "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.10", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64"}, {"url": "https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58"}, {"url": "https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status. The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code. During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout. If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.10", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "6.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:15.471Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46842", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:35:15.471Z", "dateReserved": "2024-09-11T15:12:18.289Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-27T12:39:36.370Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c6d8cce685d6088d795b29a0f47e6fd04548fd64", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git"}, {"lessThan": "bba47fe3b038cca3d3ebd799665ce69d6d273b58", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git"}, {"lessThan": "ede596b1434b57c0b3fd5c02b326efe5c54f6e48", "status": "affected", "version": "479b0917e4477f49df2e3be454aac3cfa5dec171", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/lpfc/lpfc_els.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "75C6119D-9E8D-431D-813F-FE84579072CB", "versionEndExcluding": "6.10.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status. The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code. During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout. If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Controlar los tiempos de espera del buz\u00f3n en lpfc_get_sfp_info El c\u00f3digo de retorno MBX_TIMEOUT no se maneja en lpfc_get_sfp_info y la rutina libera incondicionalmente los comandos de buz\u00f3n enviados independientemente del estado de retorno. El problema es que para los casos de MBX_TIMEOUT, cuando el firmware devuelve informaci\u00f3n SFP en un momento posterior, esa misma regi\u00f3n de memoria del buz\u00f3n hace referencia a la memoria liberada previamente en su rutina cmpl. Se soluciona agregando comprobaciones para el c\u00f3digo de retorno MBX_TIMEOUT. Durante la limpieza de recursos del buz\u00f3n, verifique el indicador mbox para asegurarse de que la espera no haya expirado. Si el indicador MBOX_WAKE no est\u00e1 configurado, no libere los recursos porque se liberar\u00e1n cuando el firmware complete el buz\u00f3n en un momento posterior en su rutina cmpl. Adem\u00e1s, aumente el tiempo de espera de 30 a 60 segundos para dar cabida a los scripts de arranque que requieren tiempos de espera m\u00e1s largos."}], "id": "CVE-2024-46842", "lastModified": "2026-10-21T13:17:48.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46842", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-29T13:59:24.823160Z", "version": "2.0.3"}}]}, "published": "2024-09-27T13:15:16.190", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info", "id": "2315194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315194"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status. The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\nFix by adding checks for the MBX_TIMEOUT return code. During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout. If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts."], "name": "CVE-2024-46842", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46842\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46842\nhttps://lore.kernel.org/linux-cve-announce/2024092754-CVE-2024-46842-e52c@gregkh/T"], "threat_severity": "Moderate"}

{}