Linux Kernel Event Acknowledgment Command Initialization Vulnerability in mpi3mr SCSI Driver

A use-after-free vulnerability has been identified in the Linux kernel's SCSI mpi3mr driver. This issue arises from a missing initialization of the event acknowledgment command array in the driver. The vulnerability was introduced in a previous commit that added event acknowledgment logic but failed to properly initialize the array elements. As a result, the host_tag field of the elements contained a zero value, leading to incorrect memory access and a 'BUG: KASAN: use-after-free' error. This vulnerability was observed during a firmware update on the eHBA-9600 controller.

Impact

Exploitation of this vulnerability causes a use-after-free memory error, which can lead to undefined behavior such as memory corruption or arbitrary code execution.

Remediation

The vulnerability has been fixed in the Linux kernel. Users can apply the latest patches available in the Linux kernel stable tree.