CVE-2023-52796

一、漏洞信息
 漏洞编号：[CVE-2023-52796](https://nvd.nist.gov/vuln/detail/CVE-2023-52796)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ipvlan: add ipvlan_route_v6_outbound() helperInspired by syzbot reports using a stack of multiple ipvlan devices.Reduce stack size needed in ipvlan_process_v6_outbound() by movingthe flowi6 struct used for the route lookup in an non inlinedhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,immediately reclaimed.Also make sure ipvlan_process_v4_outbound() is not inlined.We might also have to lower MAX_NEST_DEV, because only syzbot usessetups with more than four stacked devices.BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)stack guard page: 0000 [#1] SMP KASANCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89RSP: 0018:ffffc9000e804000 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080cR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:<#DF></#DF><TASK>[<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31[<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline][<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline][<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline][<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline][<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline][<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632[<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306[<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline][<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221[<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606[<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline][<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116[<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638[<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651[<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline][<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline][<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline][<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline][<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline][<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline][<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline][<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline][<f---truncated---
 漏洞公开时间：2024-05-22 00:15:18
 漏洞创建时间：2024-05-22 22:08:40
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52796
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52796 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52796.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52796 | https://bugzilla.suse.com/show_bug.cgi?id=1224930 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052158-CVE-2023-52796-860d@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2282766 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5102 | https://bugzilla.redhat.com/show_bug.cgi?id=2282766 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5101 | https://bugzilla.redhat.com/show_bug.cgi?id=2282766 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52796 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-52796 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ipvlan: add ipvlan_route_v6_outbound() helperInspired by syzbot reports using a stack of multiple ipvlan devices.Reduce stack size needed in ipvlan_process_v6_outbound() by movingthe flowi6 struct used for the route lookup in an non inlinedhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,immediately reclaimed.Also make sure ipvlan_process_v4_outbound() is not inlined.We might also have to lower MAX_NEST_DEV, because only syzbot usessetups with more than four stacked devices.BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)stack guard page: 0000 [#1] SMP KASANCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89RSP: 0018:ffffc9000e804000 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080cR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:<#DF></#DF><TASK>[<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31[<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline][<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline][<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline][<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline][<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline][<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632[<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306[<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline][<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221[<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606[<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline][<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116[<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638[<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651[<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline][<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline][<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline][<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline][<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline][<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline][<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline][<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline][<f---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (16)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52796

Comments (16)

Search

src-openEuler/kernel
Closed