CVE-2021-46955

一、漏洞信息
 漏洞编号：[CVE-2021-46955](https://nvd.nist.gov/vuln/detail/CVE-2021-46955)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:openvswitch: fix stack OOB read while fragmenting IPv4 packetsrunning openvswitch on kernels built with KASAN, it s possible to see thefollowing splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace:  dump_stack+0x92/0xc1  print_address_description.constprop.7+0x1a/0x150  kasan_report.cold.13+0x7f/0x111  ip_do_fragment+0x1b03/0x1f60  ovs_fragment+0x5bf/0x840 [openvswitch]  do_execute_actions+0x1bd5/0x2400 [openvswitch]  ovs_execute_actions+0xc8/0x3d0 [openvswitch]  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0  genl_rcv_msg+0x287/0x490  netlink_rcv_skb+0x120/0x380  genl_rcv+0x24/0x40  netlink_unicast+0x439/0x630  netlink_sendmsg+0x719/0xbf0  sock_sendmsg+0xe2/0x110  ____sys_sendmsg+0x5ba/0x890  ___sys_sendmsg+0xe9/0x160  __sys_sendmsg+0xd3/0x170  do_syscall_64+0x33/0x40  entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:  ovs_fragment+0x0/0x840 [openvswitch] this frame has 2 objects:  [32, 144)  ovs_dst   [192, 424)  ovs_rt  Memory state around the buggy address:  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00                                         ^  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,in the following call graph:  ip_do_fragment()    ip_skb_dst_mtu()      ip_dst_mtu_maybe_forward()        ip_mtu_locked()the pointer to struct dst_entry is used as pointer to struct rtable: thisturns the access to struct members like rt_mtu_locked into an OOB read inthe stack. Fix this changing the temporary variable used for IPv4 packetsin ovs_fragment(), similarly to what is done for IPv6 few lines below.
 漏洞公开时间：2024-02-28 03:04:06
 漏洞创建时间：2024-02-28 03:31:02
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-46955
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46955 | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-46955 | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/23e17ec1a5eb53fe39cc34fa5592686d5acd0dac | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/490ad0a2390442d0a7b8c00972a83dbb09cab142 | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/5a52fa8ad45b5a593ed416adf326538638454ff1 | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/7c0ea5930c1c211931819d83cfb157bff1539a4c | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/a1478374b0bda89b4277a8afd39208271faad4be | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/b1d7280f9ba1bfdbc3af5bdb82e51f014854f26f | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/b3502b04e84ac5349be95fc033c17bd701d2787a | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/d841d3cf5297fde4ce6a41ff35451d0e82917f3e | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| suse_bugzilla | https://git.kernel.org/stable/c/df9e900de24637be41879e2c50afb713ec4e8b2e | https://bugzilla.suse.com/show_bug.cgi?id=1220513 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024022718-CVE-2021-46955-b50b@gregkh/T/#u | https://bugzilla.redhat.com/show_bug.cgi?id=2266468 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:openvswitch: fix stack OOB read while fragmenting IPv4 packetsrunning openvswitch on kernels built with KASAN, it s possible to see thefollowing splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace:  dump_stack+0x92/0xc1  print_address_description.constprop.7+0x1a/0x150  kasan_report.cold.13+0x7f/0x111  ip_do_fragment+0x1b03/0x1f60  ovs_fragment+0x5bf/0x840 [openvswitch]  do_execute_actions+0x1bd5/0x2400 [openvswitch]  ovs_execute_actions+0xc8/0x3d0 [openvswitch]  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0  genl_rcv_msg+0x287/0x490  netlink_rcv_skb+0x120/0x380  genl_rcv+0x24/0x40  netlink_unicast+0x439/0x630  netlink_sendmsg+0x719/0xbf0  sock_sendmsg+0xe2/0x110  ____sys_sendmsg+0x5ba/0x890  ___sys_sendmsg+0xe9/0x160  __sys_sendmsg+0xd3/0x170  do_syscall_64+0x33/0x40  entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:  ovs_fragment+0x0/0x840 [openvswitch] this frame has 2 objects:  [32, 144)  ovs_dst   [192, 424)  ovs_rt  Memory state around the buggy address:  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00                                         ^  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,in the following call graph:  ip_do_fragment()    ip_skb_dst_mtu()      ip_dst_mtu_maybe_forward()        ip_mtu_locked()the pointer to struct dst_entry is used as pointer to struct rtable: thisturns the access to struct members like rt_mtu_locked into an OOB read inthe stack. Fix this changing the temporary variable used for IPv4 packetsin ovs_fragment(), similarly to what is done for IPv6 few lines below.  
 openEuler评分：
  2.6
 Vector：CVSS：2.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS(5.10.0):不受影响
4.openEuler-22.03-LTS-SP1(5.10.0):不受影响
5.openEuler-22.03-LTS-SP2(5.10.0):不受影响
6.openEuler-22.03-LTS-SP3:不受影响
7.master(6.1.0):不受影响
8.openEuler-22.03-LTS-Next(5.10.0):不受影响
9.openEuler-24.03-LTS:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3:否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1346

src-openEuler/kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2021-46955

Comments (8)

Search

src-openEuler/kernel
Closed