CVE-2023-52506

一、漏洞信息
 漏洞编号：[CVE-2023-52506](https://nvd.nist.gov/vuln/detail/CVE-2023-52506)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：6.1.19
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  A vulnerability was found in Linux Kernel up to 6.1.55/6.5.5 (Operating System). It has been classified as problematic.CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.1.56, 6.5.6 or 6.6 eliminates this vulnerability. Applying the patch f105e893a8ed/19878758accf/b795fb9f5861 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.
 漏洞公开时间：2024-03-02 00:00:00
 漏洞创建时间：2024-03-02 22:59:14
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52506
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/19878758accf6b2788091a771d9f9fee7bab11ab |  |
|  | https://git.kernel.org/stable/c/b795fb9f5861ee256070d59e33130980a01fadd7 |  |
|  | https://git.kernel.org/stable/c/f105e893a8edd48bdf4bef9fef845a9ff402f737 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52506 |  |
|  | https://git.kernel.org/linus/b795fb9f5861ee256070d59e33130980a01fadd7 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2023-52506 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  | https://git.kernel.org/stable/c/f105e893a8edd48bdf4bef9fef845a9f | https://git.kernel.org/stable/c/f105e893a8edd48bdf4bef9fef845a9ff402f737.patch |  | ljqc |
|  | https://git.kernel.org/stable/c/19878758accf6b2788091a771d9f9fee | https://git.kernel.org/stable/c/19878758accf6b2788091a771d9f9fee7bab11ab.patch |  | ljqc |
|  | https://git.kernel.org/stable/c/b795fb9f5861ee256070d59e33130980 | https://git.kernel.org/stable/c/b795fb9f5861ee256070d59e33130980a01fadd7.patch |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:LoongArch: Set all reserved memblocks on Node#0 at initializationAfter commit 61167ad5fecdea ( mm: pass nid to reserve_bootmem_region() )we get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18[    0.000000] Oops[#1]:[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733[    0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90[    0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0[    0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000[    0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800[    0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20[    0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000[    0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000[    0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000[    0.000000]    ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c[    0.000000]   ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c[    0.000000]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)[    0.000000]  PRMD: 00000000 (PPLV0 -PIE -PWE)[    0.000000]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)[    0.000000]  ECFG: 00070800 (LIE=11 VS=7)[    0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0)[    0.000000]  BADV: 0000000000002b82[    0.000000]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)[    0.000000] Modules linked in:[    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))[    0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00[    0.000000]         900000000470e000 90000000002c1918 0000000000000000 9000000004110780[    0.000000]         00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748[    0.000000]         0000000000000000 900000000421ca84 9000000004620000 9000000004564970[    0.000000]         90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000[    0.000000]         9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000[    0.000000]         0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918[    0.000000]         90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000[    0.000000]         90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c[    0.000000]         9000000004270008 0000000000000001 0000000000000000 90000000045ccd00[    0.000000]         ...[    0.000000] Call Trace:[    0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c[    0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350[    0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc[    0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4[    0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc[    0.000000][    0.000000] Code: 02eb21ad  00410f4c  380c31ac <262b818d> 6800b70d  02c1c196  0015001c  57fe4bb1  260002cdThe reason is early memblock_reserve() in memblock_init() set node id toMAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chainreserve_bootmem_region() -> init_reserved_page(). After memblock_init(),those late calls of memblock_reserve() operate on subregions of memblock.memory regions. As a result, these reserved regions will be set to thecorrect node at the first iteration of memmap_init_reserved_pages().So set all reserved memblocks on Node#0 at initialization can avoid thispanic. 
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1:不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS:不受影响
4.openEuler-22.03-LTS-SP1:不受影响
5.openEuler-22.03-LTS-SP2:不受影响
6.openEuler-22.03-LTS-SP3:不受影响
7.master:不受影响
8.openEuler-22.03-LTS-Next:不受影响
9.openEuler-24.03-LTS:不受影响
10.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS:否
4.openEuler-22.03-LTS-SP1:否
5.openEuler-22.03-LTS-SP2:否
6.openEuler-22.03-LTS-SP3:否
7.master:否
8.openEuler-22.03-LTS-Next:否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

原因说明：
  1.master:
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3:
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS:
7.openEuler-24.03-LTS-Next:
8.openEuler-24.03-LTS-SP1:

src-openEuler / kernel
Closed

Content Risk Flag

Comments (9)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52506

Comments (9)

Search

src-openEuler / kernel
Closed