CVE-2023-54234

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s scsi/mpi3mr module related to the initialization of the evtack cmds array within the mrioc structure. Specifically, commit c1af985d27da introduced this array but failed to initialize its elements, leading to potential memory access issues. The mpi3mr complete evt ack() function incorrectly uses a zero value from the host tag field, causing an out-of-bounds memory access and a “use-after-free” condition detected by KASAN. This issue was observed when updating eHBA-9600 firmware to version 8.3.1.0. The problem stems from the missing initialization of mrioc->evtack cmds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.