CVE-2024-57804

A flaw was found in the Linux kernel's mpi3mr SCSI driver, which exposes a sysfs interface through the SAS transport layer for enabling and disabling PHYs on a controller or expander. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current configuration pages related to the SAS IO unit and SAS Expander pages can become corrupted, which may disrupt storage connectivity and system availability on systems using mpi3mr-managed controllers. Red Hat rates this issue as LOW severity because exploitation requires local privileged access and deliberate interaction with the sysfs PHY interface, and the impact is limited to availability (Red Hat CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); this differs from the higher CVE.org score of 7.3, which also assumes confidentiality and integrity impact that is not established by the flaw's evidence. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 are affected and the fix is deferred in line with the LOW severity rating; the residual risk is that a local privileged user could corrupt the SAS IO unit and SAS Expander configuration pages through rapid PHY state changes via sysfs, affecting availability of mpi3mr-controlled storage. Red Hat Enterprise Linux 6 and 7 are not affected, and the Red Hat Enterprise Linux 8 update streams are out of support. The upstream fix uses separate memory for each configuration request.