CVE-2021-47565: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47565 is a vulnerability in the Linux kernel's mpt3sas driver that was discovered and disclosed in May 2024. The vulnerability affects the SCSI subsystem, specifically in the way the mpt3sas driver handles drive powercycle tests. While looping over the shost's sdev list, there's a possibility that one of the drives gets removed and its sas_target object is freed while its sdev object remains intact (NVD).

The vulnerability occurs in the _scsih_ublock_io_device function within the mpt3sas driver. The issue arises when the driver attempts to access the sas_address field of a sas_target object without first verifying that the sas_target object isn't NULL. This can happen during drive powercycle testing when a drive is removed, causing its sas_target object to be freed while the sdev object remains (Kernel Commit).

When triggered, this vulnerability can lead to a kernel panic, potentially causing system instability or denial of service. The issue affects systems running the Linux kernel with the mpt3sas driver, which is used for supporting 12GB SAS devices (NVD).

The vulnerability requires authenticated access and specific conditions during drive powercycle testing to be exploited. It is triggered when a drive is removed while the system is performing certain SCSI operations (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves adding an additional NULL check for the sas_target object before attempting to access its sas_address field. The patch was introduced in commit 0ee4ba13e09c9d9c1cb6abb59da8295d9952328b and has been backported to various stable kernel versions (Kernel Commit).