CVE-2024-53170

一、漏洞信息
 漏洞编号：[CVE-2024-53170](https://nvd.nist.gov/vuln/detail/CVE-2024-53170)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:block: fix uaf for flush rq while iterating tagsblk_mq_clear_flush_rq_mapping() is not called during scsi probe, bychecking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is clearedin del_gendisk by commit aec89dc5d421 ( block: keep q_usage_counter inatomic mode after del_gendisk ), hence for disk like scsi, followingblk_mq_destroy_queue() will not clear flush rq from tags->rqs[] as well,cause following uaf that is found by our syzkaller for v6.6:==================================================================BUG: KASAN: slab-use-after-free in blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261Read of size 4 at addr ffff88811c969c20 by task kworker/1:2H/224909CPU: 1 PID: 224909 Comm: kworker/1:2H Not tainted 6.6.0-ga836a5060850 #32Workqueue: kblockd blk_mq_timeout_workCall Trace:__dump_stack lib/dump_stack.c:88 [inline]dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364print_report+0x3e/0x70 mm/kasan/report.c:475kasan_report+0xb8/0xf0 mm/kasan/report.c:588blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261bt_iter block/blk-mq-tag.c:288 [inline]__sbitmap_for_each_set include/linux/sbitmap.h:295 [inline]sbitmap_for_each_set include/linux/sbitmap.h:316 [inline]bt_for_each+0x455/0x790 block/blk-mq-tag.c:325blk_mq_queue_tag_busy_iter+0x320/0x740 block/blk-mq-tag.c:534blk_mq_timeout_work+0x1a3/0x7b0 block/blk-mq.c:1673process_one_work+0x7c4/0x1450 kernel/workqueue.c:2631process_scheduled_works kernel/workqueue.c:2704 [inline]worker_thread+0x804/0xe40 kernel/workqueue.c:2785kthread+0x346/0x450 kernel/kthread.c:388ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293Allocated by task 942:kasan_save_stack+0x22/0x50 mm/kasan/common.c:45kasan_set_track+0x25/0x30 mm/kasan/common.c:52____kasan_kmalloc mm/kasan/common.c:374 [inline]__kasan_kmalloc mm/kasan/common.c:383 [inline]__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:380kasan_kmalloc include/linux/kasan.h:198 [inline]__do_kmalloc_node mm/slab_common.c:1007 [inline]__kmalloc_node+0x69/0x170 mm/slab_common.c:1014kmalloc_node include/linux/slab.h:620 [inline]kzalloc_node include/linux/slab.h:732 [inline]blk_alloc_flush_queue+0x144/0x2f0 block/blk-flush.c:499blk_mq_alloc_hctx+0x601/0x940 block/blk-mq.c:3788blk_mq_alloc_and_init_hctx+0x27f/0x330 block/blk-mq.c:4261blk_mq_realloc_hw_ctxs+0x488/0x5e0 block/blk-mq.c:4294blk_mq_init_allocated_queue+0x188/0x860 block/blk-mq.c:4350blk_mq_init_queue_data block/blk-mq.c:4166 [inline]blk_mq_init_queue+0x8d/0x100 block/blk-mq.c:4176scsi_alloc_sdev+0x843/0xd50 drivers/scsi/scsi_scan.c:335scsi_probe_and_add_lun+0x77c/0xde0 drivers/scsi/scsi_scan.c:1189__scsi_scan_target+0x1fc/0x5a0 drivers/scsi/scsi_scan.c:1727scsi_scan_channel drivers/scsi/scsi_scan.c:1815 [inline]scsi_scan_channel+0x14b/0x1e0 drivers/scsi/scsi_scan.c:1791scsi_scan_host_selected+0x2fe/0x400 drivers/scsi/scsi_scan.c:1844scsi_scan+0x3a0/0x3f0 drivers/scsi/scsi_sysfs.c:151store_scan+0x2a/0x60 drivers/scsi/scsi_sysfs.c:191dev_attr_store+0x5c/0x90 drivers/base/core.c:2388sysfs_kf_write+0x11c/0x170 fs/sysfs/file.c:136kernfs_fop_write_iter+0x3fc/0x610 fs/kernfs/file.c:338call_write_iter include/linux/fs.h:2083 [inline]new_sync_write+0x1b4/0x2d0 fs/read_write.c:493vfs_write+0x76c/0xb00 fs/read_write.c:586ksys_write+0x127/0x250 fs/read_write.c:639do_syscall_x64 arch/x86/entry/common.c:51 [inline]do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81entry_SYSCALL_64_after_hwframe+0x78/0xe2Freed by task 244687:kasan_save_stack+0x22/0x50 mm/kasan/common.c:45kasan_set_track+0x25/0x30 mm/kasan/common.c:52kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522____kasan_slab_free mm/kasan/common.c:236 [inline]__kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244kasan_slab_free include/linux/kasan.h:164 [in---truncated---
 漏洞公开时间：2024-12-27 22:15:24
 漏洞创建时间：2024-12-27 22:46:54
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-53170
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3802f73bd80766d70f319658f334754164075bc3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/61092568f2a9acb0e6e186f03f2e0649a4e86d09 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a0e93b9fefafe97d596f9c98701ae6c3b04b3ff6 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-53170 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-53170 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://git.kernel.org/stable/c/3802f73bd80766d70f319658f334754164075bc3 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://git.kernel.org/stable/c/61092568f2a9acb0e6e186f03f2e0649a4e86d09 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://git.kernel.org/stable/c/a0e93b9fefafe97d596f9c98701ae6c3b04b3ff6 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-53170.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2334396 | https://bugzilla.suse.com/show_bug.cgi?id=1234888 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-53170 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:block: fix uaf for flush rq while iterating tagsblk_mq_clear_flush_rq_mapping() is not called during scsi probe, bychecking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is clearedin del_gendisk by commit aec89dc5d421 (&#34;block: keep q_usage_counter inatomic mode after del_gendisk&#34;), hence for disk like scsi, followingblk_mq_destroy_queue() will not clear flush rq from tags-&gt;rqs[] as well,cause following uaf that is found by our syzkaller for v6.6:==================================================================BUG: KASAN: slab-use-after-free in blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261Read of size 4 at addr ffff88811c969c20 by task kworker/1:2H/224909CPU: 1 PID: 224909 Comm: kworker/1:2H Not tainted 6.6.0-ga836a5060850 #32Workqueue: kblockd blk_mq_timeout_workCall Trace:__dump_stack lib/dump_stack.c:88 [inline]dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364print_report+0x3e/0x70 mm/kasan/report.c:475kasan_report+0xb8/0xf0 mm/kasan/report.c:588blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261bt_iter block/blk-mq-tag.c:288 [inline]__sbitmap_for_each_set include/linux/sbitmap.h:295 [inline]sbitmap_for_each_set include/linux/sbitmap.h:316 [inline]bt_for_each+0x455/0x790 block/blk-mq-tag.c:325blk_mq_queue_tag_busy_iter+0x320/0x740 block/blk-mq-tag.c:534blk_mq_timeout_work+0x1a3/0x7b0 block/blk-mq.c:1673process_one_work+0x7c4/0x1450 kernel/workqueue.c:2631process_scheduled_works kernel/workqueue.c:2704 [inline]worker_thread+0x804/0xe40 kernel/workqueue.c:2785kthread+0x346/0x450 kernel/kthread.c:388ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293Allocated by task 942:kasan_save_stack+0x22/0x50 mm/kasan/common.c:45kasan_set_track+0x25/0x30 mm/kasan/common.c:52____kasan_kmalloc mm/kasan/common.c:374 [inline]__kasan_kmalloc mm/kasan/common.c:383 [inline]__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:380kasan_kmalloc include/linux/kasan.h:198 [inline]__do_kmalloc_node mm/slab_common.c:1007 [inline]__kmalloc_node+0x69/0x170 mm/slab_common.c:1014kmalloc_node include/linux/slab.h:620 [inline]kzalloc_node include/linux/slab.h:732 [inline]blk_alloc_flush_queue+0x144/0x2f0 block/blk-flush.c:499blk_mq_alloc_hctx+0x601/0x940 block/blk-mq.c:3788blk_mq_alloc_and_init_hctx+0x27f/0x330 block/blk-mq.c:4261blk_mq_realloc_hw_ctxs+0x488/0x5e0 block/blk-mq.c:4294blk_mq_init_allocated_queue+0x188/0x860 block/blk-mq.c:4350blk_mq_init_queue_data block/blk-mq.c:4166 [inline]blk_mq_init_queue+0x8d/0x100 block/blk-mq.c:4176scsi_alloc_sdev+0x843/0xd50 drivers/scsi/scsi_scan.c:335scsi_probe_and_add_lun+0x77c/0xde0 drivers/scsi/scsi_scan.c:1189__scsi_scan_target+0x1fc/0x5a0 drivers/scsi/scsi_scan.c:1727scsi_scan_channel drivers/scsi/scsi_scan.c:1815 [inline]scsi_scan_channel+0x14b/0x1e0 drivers/scsi/scsi_scan.c:1791scsi_scan_host_selected+0x2fe/0x400 drivers/scsi/scsi_scan.c:1844scsi_scan+0x3a0/0x3f0 drivers/scsi/scsi_sysfs.c:151store_scan+0x2a/0x60 drivers/scsi/scsi_sysfs.c:191dev_attr_store+0x5c/0x90 drivers/base/core.c:2388sysfs_kf_write+0x11c/0x170 fs/sysfs/file.c:136kernfs_fop_write_iter+0x3fc/0x610 fs/kernfs/file.c:338call_write_iter include/linux/fs.h:2083 [inline]new_sync_write+0x1b4/0x2d0 fs/read_write.c:493vfs_write+0x76c/0xb00 fs/read_write.c:586ksys_write+0x127/0x250 fs/read_write.c:639do_syscall_x64 arch/x86/entry/common.c:51 [inline]do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81entry_SYSCALL_64_after_hwframe+0x78/0xe2Freed by task 244687:kasan_save_stack+0x22/0x50 mm/kasan/common.c:45kasan_set_track+0x25/0x30 mm/kasan/common.c:52kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522____kasan_slab_free mm/kasan/common.c:236 [inline]__kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244kasan_slab_free include/linux/kasan.h:164 [inline]slab_free_hook mm/slub.c:1815 [inline]slab_free_freelist_hook mm/slub.c:1841 [inline]slab_free mm/slub.c:3807 [inline]__kmem_cache_free+0xe4/0x520 mm/slub.c:3820blk_free_flush_que
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS:受影响
2.openEuler-24.03-LTS-SP1:受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.openEuler-22.03-LTS-SP1:不受影响
5.openEuler-22.03-LTS-SP3:不受影响
6.openEuler-22.03-LTS-SP4:不受影响
7.master:不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.master:不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-22.03-LTS-SP1:不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1036

src-openEuler/kernel

内容风险标识

评论 (6)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-53170

评论 (6)

搜索帮助

src-openEuler/kernel