Security readout for executives and security teams
Plain-English summary
A Linux SCSI driver can access memory beyond a small allocation while adding a device. This may corrupt kernel memory, potentially causing crashes or unauthorized changes. The supplied CVSS score is 7.3, but the issue requires local, low-privileged access and relevant mpt3sas usage.
Executive priority
Treat this as a high-priority kernel maintenance issue on storage systems using mpt3sas, especially where untrusted users have local access. It is less urgent for systems without that driver or hardware path. Expedite vendor-supported updates, but do not characterize it as an actively exploited emergency.
Technical view
In mpt3sas _scsih_add_device, test_bit() and set_bit() operate on unsigned-long-sized values while the target allocation may hold only one smaller word. This can produce an eight-byte slab out-of-bounds access. The kernel fix allocates at least sizeof(unsigned long). KASAN detected the defect in a kernel worker.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel with the mpt3sas SCSI driver and its device-add path in use. The bundle lists affected releases from 4.10 through several stable lines ending at 6.10, but administrators should verify downstream backports rather than rely solely on version numbers.
Exploitation context
The supplied vector describes a local, low-complexity attack requiring low privileges and no user interaction. Potential impacts are low confidentiality loss and high integrity and availability loss. The bundle marks KEV false and provides no evidence of active exploitation or a public working exploit.
Researcher notes
The evidence demonstrates an out-of-bounds kernel memory access and supplies fixes across stable branches. It does not establish a reliable exploitation primitive, exact attacker-controlled inputs, or exploitation in the wild. The affected-version data is unusually presented, so branch ancestry and distribution backports require direct verification.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories because fixed code may be backported without changing the upstream version pattern.
- Prioritize systems actively using mpt3sas for attached storage.
- If patching is delayed, follow vendor guidance for safe interim risk reduction.
Validation and detection
- Inventory running kernel versions across Linux systems.
- Determine whether mpt3sas is present and used for active storage controllers.
- Compare vendor changelogs against the referenced stable kernel fixes.
- Confirm the corrected kernel is running after maintenance.
- Review kernel logs for matching KASAN or slab-out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40901 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e9bce7c751f6d6c7be88c0bc081a66aaf61a23eeCVE reference, Linux
- https://git.kernel.org/stable/c/19649e49a6df07cd2e03e0a11396fd3a99485ec2CVE reference, Linux
- https://git.kernel.org/stable/c/0081d2b3ae0a17a86b8cc0fa3c8bdc54e233ba16CVE reference, Linux
- https://git.kernel.org/stable/c/521f333e644c4246ca04a4fc4772edc53dd2a801CVE reference, Linux
- https://git.kernel.org/stable/c/46bab2bcd771e725ff5ca3a68ba68cfeac45676cCVE reference, Linux
- https://git.kernel.org/stable/c/9079338c5a0d1f1fee34fb1c9e99b754efe414c5CVE reference, Linux
- https://git.kernel.org/stable/c/18abb5db0aa9b2d48f7037a88b41af2eef821674CVE reference, Linux
- https://git.kernel.org/stable/c/4254dfeda82f20844299dca6c38cbffcfd499f41CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.