CVE-2024-50083

一、漏洞信息
 漏洞编号：[CVE-2024-50083](https://nvd.nist.gov/vuln/detail/CVE-2024-50083)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tcp: fix mptcp DSS corruption due to large pmtu xmitSyzkaller was able to trigger a DSS corruption:  TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies.  ------------[ cut here ]------------  WARNING: CPU: 0 PID: 5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695  Modules linked in:  CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted 6.11.0-syzkaller-08829-gaf9c191ac2a0 #0  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024  RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695  Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff  RSP: 0018:ffffc90000006db8 EFLAGS: 00010246  RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00  RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0  RBP: 1ffff110062bf1ae R08: ffffffff8ba9cf12 R09: 1ffff110062bf1b8  R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000  R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5  FS:  000055556679c380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400  Call Trace:   <IRQ>   move_skbs_to_msk net/mptcp/protocol.c:811 [inline]   mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854   subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490   tcp_data_queue+0x20fd/0x76c0 net/ipv4/tcp_input.c:5283   tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237   tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915   tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350   ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205   ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233   NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314   NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314   __netif_receive_skb_one_core net/core/dev.c:5662 [inline]   __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775   process_backlog+0x662/0x15b0 net/core/dev.c:6107   __napi_poll+0xcb/0x490 net/core/dev.c:6771   napi_poll net/core/dev.c:6840 [inline]   net_rx_action+0x89b/0x1240 net/core/dev.c:6962   handle_softirqs+0x2c5/0x980 kernel/softirq.c:554   do_softirq+0x11b/0x1e0 kernel/softirq.c:455   </IRQ>   <TASK>   __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382   local_bh_enable include/linux/bottom_half.h:33 [inline]   rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]   __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451   dev_queue_xmit include/linux/netdevice.h:3094 [inline]   neigh_hh_output include/net/neighbour.h:526 [inline]   neigh_output include/net/neighbour.h:540 [inline]   ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236   ip_local_out net/ipv4/ip_output.c:130 [inline]   __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536   __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466   tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]   tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline]   tcp_write_xmit+0x641d/0x6bf0 net/ipv4/tcp_output.c:2752   __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015   tcp_push_pending_frames include/net/tcp.h:2107 [inline]   tcp_data_snd_check net/ipv4/tcp_input.c:5714 [inline]   tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239   tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915   sk_backlog_rcv include/net/sock.h:1113 [inline]   __release_sock+0x214/0x350 net/core/sock.c:3072   release_sock+0x61/0x1f0 net/core/sock.c:3626   mptcp_push_---truncated---
 漏洞公开时间：2024-10-29 09:15:05
 漏洞创建时间：2024-10-29 09:29:22
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50083
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/229dfdc36f31a8d47433438bc0e6e1662c4ab404 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4dabcdf581217e60690467a37c956a5b8dbc6bd9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9729010a0ac5945c1bf6847dd0778d8a1a4b72ac |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ba8e65814e519eeb17d086952bce7de93f7a40da |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c38add9ac0e4d4f418e6443a688491499021add9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/db04d1848777ae52a7ab93c4591e7c0bf8f55fb4 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20250523-0010/ |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50083 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50083 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/229dfdc36f31a8d47433438bc0e6e1662c4ab404 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/4dabcdf581217e60690467a37c956a5b8dbc6bd9 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/9729010a0ac5945c1bf6847dd0778d8a1a4b72ac | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/ba8e65814e519eeb17d086952bce7de93f7a40da | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/c38add9ac0e4d4f418e6443a688491499021add9 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/stable/c/db04d1848777ae52a7ab93c4591e7c0bf8f55fb4 | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50083.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232493 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102937-CVE-2024-50083-539c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2322311 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50083 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-50083 |
| cve_search |  | https://git.kernel.org/stable/c/c38add9ac0e4d4f418e6443a688491499021add9 |
| cve_search |  | https://git.kernel.org/stable/c/9729010a0ac5945c1bf6847dd0778d8a1a4b72ac |
| cve_search |  | https://git.kernel.org/stable/c/ba8e65814e519eeb17d086952bce7de93f7a40da |
| cve_search |  | https://git.kernel.org/stable/c/229dfdc36f31a8d47433438bc0e6e1662c4ab404 |
| cve_search |  | https://git.kernel.org/stable/c/db04d1848777ae52a7ab93c4591e7c0bf8f55fb4 |
| cve_search |  | https://git.kernel.org/stable/c/4dabcdf581217e60690467a37c956a5b8dbc6bd9 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/229dfdc36f31a8d47433438bc0e6e1662c4ab404 |  | nvd |
|  |  | https://git.kernel.org/stable/c/4dabcdf581217e60690467a37c956a5b8dbc6bd9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/9729010a0ac5945c1bf6847dd0778d8a1a4b72ac |  | nvd |
|  |  | https://git.kernel.org/stable/c/ba8e65814e519eeb17d086952bce7de93f7a40da |  | nvd |
|  |  | https://git.kernel.org/stable/c/c38add9ac0e4d4f418e6443a688491499021add9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/db04d1848777ae52a7ab93c4591e7c0bf8f55fb4 |  | nvd |
| linux_kernel | 5.10.228 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c38add9ac0e4Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |
| linux_kernel | 5.15.169 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9729010a0ac5Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |
| linux_kernel | 6.1.114 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ba8e65814e51Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |
| linux_kernel | 6.6.58 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=229dfdc36f31Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |
| linux_kernel | 6.11.5 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db04d1848777Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |
| linux_kernel | 6.12-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4dabcdf58121Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85712484110d | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3:受影响
2.openEuler-22.03-LTS-SP4:受影响
3.openEuler-24.03-LTS:受影响
4.openEuler-20.03-LTS-SP4:不受影响
5.master:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-22.03-LTS-SP3:正常修复
2.openEuler-22.03-LTS-SP4:正常修复
3.openEuler-24.03-LTS:正常修复
4.master:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2367

src-openEuler/kernel

Content Risk Flag

Comments (21)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-50083

Comments (21)

Search

src-openEuler/kernel