In the Linux kernel, the following vulnerability has been resolved:
scsi: pm80xx: Set phy->enable_completion only when we wait for it
pm8001phycontrol() populates the enablecompletion pointer with a stack address, sends a PHYLINKRESET / PHYHARDRESET, waits 300 ms, and returns. The problem arises when a phy control response comes late. After 300 ms the pm8001phycontrol() function returns and the passed enablecompletion stack address is no longer valid. Late phy control response invokes complete() on a dangling enable_completion pointer which leads to a kernel crash.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2825.0,
"function_hash": "42363768498485138337703586605381766663"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b1d779647afaea9185fa2f150b1721e7c1aae89",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c",
"function": "pm8001_phy_control"
},
"id": "CVE-2024-47666-012f462c"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2825.0,
"function_hash": "42363768498485138337703586605381766663"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f14d3e1aa613311c744af32d75125e95fc8ffb84",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c",
"function": "pm8001_phy_control"
},
"id": "CVE-2024-47666-58ed95e2"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2825.0,
"function_hash": "42363768498485138337703586605381766663"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f949ef1516c0d74745ee54a0f4882c1f6c7aea",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c",
"function": "pm8001_phy_control"
},
"id": "CVE-2024-47666-8afbaefd"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36742478842320800953710518719757390472",
"202833916902391321178956612700801009501",
"227087977251106464146205630363676280199",
"266922594893197897050818145366416124178",
"282328354926017939523928287019331271240",
"336212600976867034088992475514894513479",
"119750222736681773925602134085871620145",
"97981715602526332497273171594178104696",
"99255150527934063250504320615315083627",
"43957835535870388770714551709348826729",
"244965239010620759123956045354968688764",
"97981715602526332497273171594178104696",
"13549396404018458150321830934794501883",
"33474731307972607423820328266156267933",
"159264727219388395305706015477807506867",
"97981715602526332497273171594178104696"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f14d3e1aa613311c744af32d75125e95fc8ffb84",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c"
},
"id": "CVE-2024-47666-a7df88c6"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36742478842320800953710518719757390472",
"202833916902391321178956612700801009501",
"227087977251106464146205630363676280199",
"266922594893197897050818145366416124178",
"282328354926017939523928287019331271240",
"336212600976867034088992475514894513479",
"119750222736681773925602134085871620145",
"97981715602526332497273171594178104696",
"99255150527934063250504320615315083627",
"43957835535870388770714551709348826729",
"244965239010620759123956045354968688764",
"97981715602526332497273171594178104696",
"13549396404018458150321830934794501883",
"33474731307972607423820328266156267933",
"159264727219388395305706015477807506867",
"97981715602526332497273171594178104696"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f949ef1516c0d74745ee54a0f4882c1f6c7aea",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c"
},
"id": "CVE-2024-47666-f1ec8b93"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36742478842320800953710518719757390472",
"202833916902391321178956612700801009501",
"227087977251106464146205630363676280199",
"266922594893197897050818145366416124178",
"282328354926017939523928287019331271240",
"336212600976867034088992475514894513479",
"119750222736681773925602134085871620145",
"97981715602526332497273171594178104696",
"99255150527934063250504320615315083627",
"43957835535870388770714551709348826729",
"244965239010620759123956045354968688764",
"97981715602526332497273171594178104696",
"13549396404018458150321830934794501883",
"33474731307972607423820328266156267933",
"159264727219388395305706015477807506867",
"97981715602526332497273171594178104696"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b1d779647afaea9185fa2f150b1721e7c1aae89",
"target": {
"file": "drivers/scsi/pm8001/pm8001_sas.c"
},
"id": "CVE-2024-47666-fab1b18d"
}
]