CVE-2023-53376: scsi: mpi3mr: Use number of bits to manage bitmap sizes
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Use number of bits to manage bitmap sizes
To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using
byte as unit. However, bitmap helper functions assume that bitmaps are
allocated using unsigned long as unit. This gap causes memory access beyond
the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG
was observed at firmware download to eHBA-9600. Call trace indicated that
the out-of-bounds access happened in find_first_zero_bit() called from
mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap.
To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use
number of bits, and call bitmap helper functions which take number of bits
as arguments. For memory allocation, call bitmap_zalloc() instead of
kzalloc() and krealloc(). For memory free, call bitmap_free() instead of
kfree(). For zero clear, call bitmap_clear() instead of memset().
Remove three fields for bitmap byte sizes in struct scmd_priv which are no
longer required. Replace the field dev_handle_bitmap_sz with
dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across
resize.
Security readout for executives and security teams
Plain-English summary
CVE-2023-53376 is a Linux kernel bug in the mpi3mr SCSI driver. A bitmap size mismatch can cause out-of-bounds kernel memory access during driver activity, observed during firmware download to eHBA-9600. Business urgency is highest for systems using this driver or related Broadcom/LSI MegaRAID-style HBAs. Public sources do not indicate active exploitation.
Executive priority
Treat as a targeted infrastructure patching issue, not an internet-wide emergency. Prioritize storage-heavy Linux servers using mpi3mr-supported HBAs because kernel memory corruption can affect service availability and data confidentiality. No active exploitation is documented in the provided sources.
Technical view
The mpi3mr driver allocated bitmap storage using byte-based sizing while Linux bitmap helpers operate on unsigned-long units and bit counts. This can trigger slab out-of-bounds access in find_first_zero_bit(), called from mpi3mr_send_event_ack() for evtack_cmds_bitmap. The fix changes bitmap management to bit counts and uses bitmap_zalloc(), bitmap_free(), and bitmap_clear().
Likely exposure
Exposure is likely limited to Linux systems with the mpi3mr SCSI driver in use, especially hosts using supported HBA hardware such as the eHBA-9600 scenario mentioned in the kernel description. The CVE record lists Linux kernel versions including 5.14, 6.1.18, 6.2.5, and 6.3 as affected.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high confidentiality and availability impact. The source bundle shows no CISA KEV listing and provides no public evidence of active exploitation. The observed failure was a KASAN slab out-of-bounds bug during firmware download activity.
Researcher notes
Evidence is based on the CVE record and Linux stable commits. The affected-version data in the bundle is sparse and commit-oriented, so distribution backports must be verified with vendor advisories. Avoid assuming exploitability beyond the stated local, low-privilege CVSS context.
Mitigation direction
Prioritize kernel updates from your Linux distribution or vendor.
Confirm the vendor kernel includes one of the referenced stable fixes.
Patch or replace affected kernels on systems using mpi3mr hardware.
If patching is delayed, review vendor guidance for supported risk reductions.
Validation and detection
Inventory Linux hosts with the mpi3mr driver loaded or packaged.
Identify kernel versions and compare against vendor fixed builds.
Check vendor advisories for backported fixes matching the referenced commits.
Review kernel logs for mpi3mr or KASAN out-of-bounds messages.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-125 · source CWE mapping
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.