CVE-2024-26931

一、漏洞信息
漏洞编号：CVE-2024-26931
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:scsi: qla2xxx: Fix command flush on cable pullSystem crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logoutThe system was under memory stress where driver was not able to allocate anSRB to carry out error recovery of cable pull. The failure to flush causesupper layer to start modifying scsi_cmnd. When the system frees up somememory, the subsequent cable pull trigger another command flush. At thispoint the driver access a null pointer when attempting to DMA unmap theSGL.Add a check to make sure commands are flush back on session tear down toprevent the null pointer access.
漏洞公开时间：2024-05-01 14:15:07
漏洞创建时间：2024-05-01 14:23:33
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2024-26931

更多参考(点击展开)

参考来源	参考链接	来源链接
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26931	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://www.cve.org/CVERecord?id=CVE-2024-26931	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26931.mbox	https://bugzilla.suse.com/show_bug.cgi?id=1223627
suse_bugzilla	https://bugzilla.redhat.com/show_bug.cgi?id=2278245	https://bugzilla.suse.com/show_bug.cgi?id=1223627
redhat_bugzilla	https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26931-01d9@gregkh/T	https://bugzilla.redhat.com/show_bug.cgi?id=2278245
ubuntu	https://www.cve.org/CVERecord?id=CVE-2024-26931	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/linus/a27d4d0e7de305def8a5098a614053be208d1aa1 (6.9-rc2)	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2024-26931	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://launchpad.net/bugs/cve/CVE-2024-26931	https://ubuntu.com/security/CVE-2024-26931
ubuntu	https://security-tracker.debian.org/tracker/CVE-2024-26931	https://ubuntu.com/security/CVE-2024-26931
debian		https://security-tracker.debian.org/tracker/CVE-2024-26931
cve_search		https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a
cve_search		https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
cve_search		https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
cve_search		https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
cve_search		https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
cve_search		https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d
cve_search		https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d
cve_search		https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150
cve_search		https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
linux		https://git.kernel.org/linus/a27d4d0e7de305def8a5098a614053be208d1aa1	https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2	ubuntu

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

@YangYingliang ,@jiaoff ,@AlexGuo ,@hanjun-guo ,@woqidaideshi ,@Jackie Liu ,@Zhang Yi ,@colyli ,@ThunderTown ,@htforge ,@Chiqijun ,@冷嘲啊 ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@Kefeng ,@SuperSix173 ,@WangShaoBo ,@Zheng Zucheng ,@陈结松
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.

影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响):
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2024-26931	None	None	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1 https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211 https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150 https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
https://ubuntu.com/security/CVE-2024-26931	None	None	https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2024-26931	None	None	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1 https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211 https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150 https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-26931
https://security-tracker.debian.org/tracker/CVE-2024-26931	None	None	https://git.kernel.org/linus/a27d4d0e7de305def8a5098a614053be208d1aa1

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

@ci-robot 请确认分支: master,openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS,openEuler-22.03-LTS-Next,openEuler-22.03-LTS-SP1,openEuler-22.03-LTS-SP2,openEuler-22.03-LTS-SP3,openEuler-24.03-LTS,openEuler-24.03-LTS-Next 受影响/不受影响.
请确认分支信息是否填写完整,否则将无法关闭当前issue.

@openeuler-sync-bot 请确认分支: master,openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS,openEuler-22.03-LTS-Next,openEuler-22.03-LTS-SP1,openEuler-22.03-LTS-SP2,openEuler-22.03-LTS-SP3,openEuler-24.03-LTS,openEuler-24.03-LTS-Next 受影响/不受影响.
请确认分支信息是否填写完整,否则将无法关闭当前issue.

src-openEuler / kernel

内容风险标识

评论 (6)

src-openEuler / kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-26931

评论 (6)

搜索帮助

src-openEuler / kernel