CVE-2024-43880

一、漏洞信息
 漏洞编号：[CVE-2024-43880](https://nvd.nist.gov/vuln/detail/CVE-2024-43880)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_erp: Fix object nesting warningACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former cancontain more ACLs (i.e., tc filters), but the number of masks in eachregion (i.e., tc chain) is limited.In order to mitigate the effects of the above limitation, the deviceallows filters to share a single mask if their masks only differ in upto 8 consecutive bits. For example, dst_ip/25 can be represented usingdst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on thenumber of masks being used (and therefore does not support maskaggregation), but can contain a limited number of filters.The driver uses the  objagg  library to perform the mask aggregation bypassing it objects that consist of the filter s mask and whether thefilter is to be inserted into the A-TCAM or the C-TCAM since filters indifferent TCAMs cannot share a mask.The set of created objects is dependent on the insertion order of thefilters and is not necessarily optimal. Therefore, the driver willperiodically ask the library to compute a more optimal set ( hints ) bylooking at all the existing objects.When the library asks the driver whether two objects can be aggregatedthe driver only compares the provided masks and ignores the A-TCAM /C-TCAM indication. This is the right thing to do since the goal is tomove as many filters as possible to the A-TCAM. The driver also forbidstwo identical masks from being aggregated since this can only happen ifone was intentionally put in the C-TCAM to avoid a conflict in theA-TCAM.The above can result in the following set of hints:H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + deltaH3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + deltaAfter getting the hints from the library the driver will start migratingfilters from one region to another while consulting the computed hintsand instructing the device to perform a lookup in both regions duringthe transition.Assuming a filter with mask X is being migrated into the A-TCAM in thenew region, the hints lookup will return H1. Since H2 is the parent ofH1, the library will try to find the object associated with it andcreate it if necessary in which case another hints lookup (recursive)will be performed. This hints lookup for {mask Y, A-TCAM} will eitherreturn H2 or H3 since the driver passes the library an object comparisonfunction that ignores the A-TCAM / C-TCAM indication.This can eventually lead to nested objects which are not supported bythe library [1].Fix by removing the object comparison function from both the driver andthe library as the driver was the only user. That way the lookup willonly return exact matches.I do not have a reliable reproducer that can reproduce the issue in atimely manner, but before the fix the issue would reproduce in severalminutes and with the fix it does not reproduce in over an hour.Note that the current usefulness of the hints is limited because theyinclude the C-TCAM indication and represent aggregation that cannotactually happen. This will be addressed in net-next.[1]WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0Modules linked in:CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0[...]Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
 漏洞公开时间：2024-08-21 09:15:12
 漏洞创建时间：2024-08-21 10:24:24
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-43880
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0e59c2d22853266704e127915653598f7f104037 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/25c6fd9648ad05da493a5d30881896a78a08b624 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/36a9996e020dd5aa325e0ecc55eb2328288ea6bb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4dc09f6f260db3c4565a4ec52ba369393598f2fb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/97d833ceb27dc19f8777d63f90be4a27b5daeedf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9a5261a984bba4f583d966c550fa72c33ff3714e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fb5d4fc578e655d113f09565f6f047e15f7ab578 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-43880 | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-43880 | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/0e59c2d22853266704e127915653598f7f104037 | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/25c6fd9648ad05da493a5d30881896a78a08b624 | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/36a9996e020dd5aa325e0ecc55eb2328288ea6bb | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/4dc09f6f260db3c4565a4ec52ba369393598f2fb | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/97d833ceb27dc19f8777d63f90be4a27b5daeedf | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/9a5261a984bba4f583d966c550fa72c33ff3714e | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/stable/c/fb5d4fc578e655d113f09565f6f047e15f7ab578 | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-43880.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229481 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-43880 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/linus/97d833ceb27dc19f8777d63f90be4a27b5daeedf (6.11-rc1) | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/4dc09f6f260db3c4565a4ec52ba369393598f2fb | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/36a9996e020dd5aa325e0ecc55eb2328288ea6bb | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/9a5261a984bba4f583d966c550fa72c33ff3714e | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/25c6fd9648ad05da493a5d30881896a78a08b624 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/0e59c2d22853266704e127915653598f7f104037 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/fb5d4fc578e655d113f09565f6f047e15f7ab578 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://git.kernel.org/stable/c/97d833ceb27dc19f8777d63f90be4a27b5daeedf | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-43880 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-43880 | https://ubuntu.com/security/CVE-2024-43880 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-43880 | https://ubuntu.com/security/CVE-2024-43880 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-43880 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-43880 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0309.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.4.282 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4dc09f6f260dIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 5.10.224 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=36a9996e020dIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 5.15.165 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9a5261a984bbIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 6.1.103 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=25c6fd9648adIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 6.6.44 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e59c2d22853Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 6.10.3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fb5d4fc578e6Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux_kernel | 6.11-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=97d833ceb27dPlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9069a3817d82 | linuxkernelcves |
| linux |  | https://git.kernel.org/linus/97d833ceb27dc19f8777d63f90be4a27b5daeedf | https://git.kernel.org/linus/9069a3817d82b01b3a55da382c774e3575946130 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_erp: Fix object nesting warningACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former cancontain more ACLs (i.e., tc filters), but the number of masks in eachregion (i.e., tc chain) is limited.In order to mitigate the effects of the above limitation, the deviceallows filters to share a single mask if their masks only differ in upto 8 consecutive bits. For example, dst_ip/25 can be represented usingdst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on thenumber of masks being used (and therefore does not support maskaggregation), but can contain a limited number of filters.The driver uses the  objagg  library to perform the mask aggregation bypassing it objects that consist of the filter s mask and whether thefilter is to be inserted into the A-TCAM or the C-TCAM since filters indifferent TCAMs cannot share a mask.The set of created objects is dependent on the insertion order of thefilters and is not necessarily optimal. Therefore, the driver willperiodically ask the library to compute a more optimal set ( hints ) bylooking at all the existing objects.When the library asks the driver whether two objects can be aggregatedthe driver only compares the provided masks and ignores the A-TCAM /C-TCAM indication. This is the right thing to do since the goal is tomove as many filters as possible to the A-TCAM. The driver also forbidstwo identical masks from being aggregated since this can only happen ifone was intentionally put in the C-TCAM to avoid a conflict in theA-TCAM.The above can result in the following set of hints:H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + deltaH3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + deltaAfter getting the hints from the library the driver will start migratingfilters from one region to another while consulting the computed hintsand instructing the device to perform a lookup in both regions duringthe transition.Assuming a filter with mask X is being migrated into the A-TCAM in thenew region, the hints lookup will return H1. Since H2 is the parent ofH1, the library will try to find the object associated with it andcreate it if necessary in which case another hints lookup (recursive)will be performed. This hints lookup for {mask Y, A-TCAM} will eitherreturn H2 or H3 since the driver passes the library an object comparisonfunction that ignores the A-TCAM / C-TCAM indication.This can eventually lead to nested objects which are not supported bythe library [1].Fix by removing the object comparison function from both the driver andthe library as the driver was the only user. That way the lookup willonly return exact matches.I do not have a reliable reproducer that can reproduce the issue in atimely manner, but before the fix the issue would reproduce in severalminutes and with the fix it does not reproduce in over an hour.Note that the current usefulness of the hints is limited because theyinclude the C-TCAM indication and represent aggregation that cannotactually happen. This will be addressed in net-next.[1]WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0Modules linked in:CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0[...]Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
3.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
4.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1097

src-openEuler/kernel

内容风险标识

评论 (34)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-43880

评论 (34)

搜索帮助

src-openEuler/kernel