CVE-2024-26636

一、漏洞信息
 漏洞编号：[CVE-2024-26636](https://nvd.nist.gov/vuln/detail/CVE-2024-26636)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:llc: make llc_ui_sendmsg() more robust against bonding changessyzbot was able to trick llc_ui_sendmsg(), allocating an skb with noheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]Like some others, llc_ui_sendmsg() releases the socket lock beforecalling sock_alloc_send_skb().Then it acquires it again, but does not redo all the sanity checksthat were performed.This fix:- Uses LL_RESERVED_SPACE() to reserve space.- Check all conditions again after socket lock is held again.- Do not account Ethernet header for mtu limitation.[1]skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 !Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMPModules linked in:CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203sp : ffff800096f97000x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261cex17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089Call trace:  skb_panic net/core/skbuff.c:189 [inline]  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203  skb_push+0xf0/0x108 net/core/skbuff.c:2451  eth_header+0x44/0x1f8 net/ethernet/eth.c:83  dev_hard_header include/linux/netdevice.h:3188 [inline]  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]  llc_sap_next_state net/llc/llc_sap.c:182 [inline]  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg net/socket.c:745 [inline]  sock_sendmsg+0x194/0x274 net/socket.c:767  splice_to_socket+0x7cc/0xd58 fs/splice.c:881  do_splice_from fs/splice.c:933 [inline]  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088  do_splice_direct+0x20c/0x348 fs/splice.c:1194  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254  __do_sys_sendfile64 fs/read_write.c:1322 [inline]  __se_sys_sendfile64 fs/read_write.c:1308 [inline]  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)
 漏洞公开时间：2024-03-18 19:15:10
 漏洞创建时间：2024-03-18 20:11:10
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26636
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/04f2a74b562f3a7498be0399309669f342793d8c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6d53b813ff8b177f86f149c2f744442681f720e4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b643d0defcbacd7fe548bc65c3e4e6f17dc5eb2d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c22044270da68881074fda81a7d34812726cb249 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c451c008f563d56d5e676c9dcafae565fcad84bb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cafd3ad3fe03ef4d6632747be9ee15dc0029db4b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dad555c816a50c6a6a8a86be1f9177673918c647 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26636 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26636 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/04f2a74b562f3a7498be0399309669f342793d8c | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/6d53b813ff8b177f86f149c2f744442681f720e4 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/b643d0defcbacd7fe548bc65c3e4e6f17dc5eb2d | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/c22044270da68881074fda81a7d34812726cb249 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/c451c008f563d56d5e676c9dcafae565fcad84bb | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/cafd3ad3fe03ef4d6632747be9ee15dc0029db4b | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://git.kernel.org/stable/c/dad555c816a50c6a6a8a86be1f9177673918c647 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2270110 | https://bugzilla.suse.com/show_bug.cgi?id=1221659 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/20240318101458.2835626-14-lee@kernel.org/T | https://bugzilla.redhat.com/show_bug.cgi?id=2270110 |
| ubuntu | https://git.kernel.org/linus/dad555c816a50c6a6a8a86be1f9177673918c647 (6.8-rc2) | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/b643d0defcbacd7fe548bc65c3e4e6f17dc5eb2d | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/04f2a74b562f3a7498be0399309669f342793d8c | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/c22044270da68881074fda81a7d34812726cb249 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/6d53b813ff8b177f86f149c2f744442681f720e4 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/cafd3ad3fe03ef4d6632747be9ee15dc0029db4b | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/c451c008f563d56d5e676c9dcafae565fcad84bb | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://git.kernel.org/stable/c/dad555c816a50c6a6a8a86be1f9177673918c647 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26636 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://ubuntu.com/security/notices/USN-6765-1 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://ubuntu.com/security/notices/USN-6766-1 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://ubuntu.com/security/notices/USN-6767-1 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://ubuntu.com/security/notices/USN-6767-2 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://ubuntu.com/security/notices/USN-6766-2 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26636 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26636 | https://ubuntu.com/security/CVE-2024-26636 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26636 | https://ubuntu.com/security/CVE-2024-26636 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26636 |
| cve_search |  | https://git.kernel.org/stable/c/84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b |
| cve_search |  | https://git.kernel.org/stable/c/b643d0defcbacd7fe548bc65c3e4e6f17dc5eb2d |
| cve_search |  | https://git.kernel.org/stable/c/04f2a74b562f3a7498be0399309669f342793d8c |
| cve_search |  | https://git.kernel.org/stable/c/c22044270da68881074fda81a7d34812726cb249 |
| cve_search |  | https://git.kernel.org/stable/c/6d53b813ff8b177f86f149c2f744442681f720e4 |
| cve_search |  | https://git.kernel.org/stable/c/cafd3ad3fe03ef4d6632747be9ee15dc0029db4b |
| cve_search |  | https://git.kernel.org/stable/c/c451c008f563d56d5e676c9dcafae565fcad84bb |
| cve_search |  | https://git.kernel.org/stable/c/dad555c816a50c6a6a8a86be1f9177673918c647 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26636 | https://ubuntu.com/security/CVE-2024-26636 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/dad555c816a50c6a6a8a86be1f9177673918c647 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:llc: make llc_ui_sendmsg() more robust against bonding changessyzbot was able to trick llc_ui_sendmsg(), allocating an skb with noheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]Like some others, llc_ui_sendmsg() releases the socket lock beforecalling sock_alloc_send_skb().Then it acquires it again, but does not redo all the sanity checksthat were performed.This fix:- Uses LL_RESERVED_SPACE() to reserve space.- Check all conditions again after socket lock is held again.- Do not account Ethernet header for mtu limitation.[1]skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 !Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMPModules linked in:CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203sp : ffff800096f97000x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261cex17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089Call trace:  skb_panic net/core/skbuff.c:189 [inline]  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203  skb_push+0xf0/0x108 net/core/skbuff.c:2451  eth_header+0x44/0x1f8 net/ethernet/eth.c:83  dev_hard_header include/linux/netdevice.h:3188 [inline]  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]  llc_sap_next_state net/llc/llc_sap.c:182 [inline]  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg net/socket.c:745 [inline]  sock_sendmsg+0x194/0x274 net/socket.c:767  splice_to_socket+0x7cc/0xd58 fs/splice.c:881  do_splice_from fs/splice.c:933 [inline]  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088  do_splice_direct+0x20c/0x348 fs/splice.c:1194  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254  __do_sys_sendfile64 fs/read_write.c:1322 [inline]  __se_sys_sendfile64 fs/read_write.c:1308 [inline]  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)  
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS(5.10.0):受影响
4.openEuler-22.03-LTS-SP1(5.10.0):受影响
5.openEuler-22.03-LTS-SP2(5.10.0):受影响
6.openEuler-22.03-LTS-SP3(5.10.0):受影响
7.master(6.1.0):不受影响
8.openEuler-22.03-LTS-Next(5.10.0):不受影响
9.openEuler-24.03-LTS:不受影响
10.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1649

src-openEuler/kernel
Closed

Content Risk Flag

Comments (25)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26636

Comments (25)

Search

src-openEuler/kernel
Closed