CVE-2024-26645

一、漏洞信息
 漏洞编号：[CVE-2024-26645](https://nvd.nist.gov/vuln/detail/CVE-2024-26645)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tracing: Ensure visibility when inserting an element into tracing_mapRunning the following two commands in parallel on a multi-processorAArch64 machine can sporadically produce an unexpected warning aboutduplicate histogram entries: $ while true; do     echo hist:key=id.syscall:val=hitcount >         /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist     sleep 0.001   done $ stress-ng --sysbadaddr $(nproc)The warning looks as follows:[ 2911.172474] ------------[ cut here ]------------[ 2911.173111] Duplicates detected: 1[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408[ 2911.185310] sp : ffff8000a1513900[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480[ 2911.194259] Call trace:[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408[ 2911.195220]  hist_show+0x124/0x800[ 2911.195692]  seq_read_iter+0x1d4/0x4e8[ 2911.196193]  seq_read+0xe8/0x138[ 2911.196638]  vfs_read+0xc8/0x300[ 2911.197078]  ksys_read+0x70/0x108[ 2911.197534]  __arm64_sys_read+0x24/0x38[ 2911.198046]  invoke_syscall+0x78/0x108[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8[ 2911.199157]  do_el0_svc+0x28/0x40[ 2911.199613]  el0_svc+0x40/0x178[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0[ 2911.201115] ---[ end trace 0000000000000000 ]---The problem appears to be caused by CPU reordering of writes issued from__tracing_map_insert().The check for the presence of an element with a given key in thisfunction is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ...The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt;The  memcpy(elt->key, key, map->key_size);  and  entry->val = elt; stores may become visible in the reversed order on another CPU. Thissecond CPU might then incorrectly determine that a new key doesn t matchan already present val->key and subse---truncated---
 漏洞公开时间：2024-03-27 00:15:12
 漏洞创建时间：2024-03-27 00:49:02
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26645
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2b44760609e9eaafc9d234a6883d042fc21132a7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5022b331c041e8c54b9a6a3251579bd1e8c0fc0b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a1eebe76e187dbe11ca299f8dbb6e45d5b1889e7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/aef1cb00856ccfd614467cfb50b791278992e177 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bf4aeff7da85c3becd39fb73bac94122331c30fb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dad9b28f675ed99b4dec261db2a397efeb80b74c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ef70dfa0b1e5084f32635156c9a5c795352ad860 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f4f7e696db0274ff560482cc52eddbf0551d4b7a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26645 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/2b44760609e9eaafc9d234a6883d042fc21132a7 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/5022b331c041e8c54b9a6a3251579bd1e8c0fc0b | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/a1eebe76e187dbe11ca299f8dbb6e45d5b1889e7 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/aef1cb00856ccfd614467cfb50b791278992e177 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/bf4aeff7da85c3becd39fb73bac94122331c30fb | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/dad9b28f675ed99b4dec261db2a397efeb80b74c | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/ef70dfa0b1e5084f32635156c9a5c795352ad860 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://git.kernel.org/stable/c/f4f7e696db0274ff560482cc52eddbf0551d4b7a | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26645 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2271648 | https://bugzilla.suse.com/show_bug.cgi?id=1222056 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/20240326151722.1258576-4-lee@kernel.org/T | https://bugzilla.redhat.com/show_bug.cgi?id=2271648 |
| ubuntu | https://git.kernel.org/linus/2b44760609e9eaafc9d234a6883d042fc21132a7 (6.8-rc2) | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/5022b331c041e8c54b9a6a3251579bd1e8c0fc0b | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/dad9b28f675ed99b4dec261db2a397efeb80b74c | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/ef70dfa0b1e5084f32635156c9a5c795352ad860 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/aef1cb00856ccfd614467cfb50b791278992e177 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/f4f7e696db0274ff560482cc52eddbf0551d4b7a | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/a1eebe76e187dbe11ca299f8dbb6e45d5b1889e7 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/bf4aeff7da85c3becd39fb73bac94122331c30fb | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://git.kernel.org/stable/c/2b44760609e9eaafc9d234a6883d042fc21132a7 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26645 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6765-1 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6766-1 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6767-1 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6767-2 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6766-2 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://ubuntu.com/security/notices/USN-6766-3 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26645 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26645 | https://ubuntu.com/security/CVE-2024-26645 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26645 | https://ubuntu.com/security/CVE-2024-26645 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26645 |
| cve_search |  | https://git.kernel.org/stable/c/5022b331c041e8c54b9a6a3251579bd1e8c0fc0b |
| cve_search |  | https://git.kernel.org/stable/c/dad9b28f675ed99b4dec261db2a397efeb80b74c |
| cve_search |  | https://git.kernel.org/stable/c/ef70dfa0b1e5084f32635156c9a5c795352ad860 |
| cve_search |  | https://git.kernel.org/stable/c/aef1cb00856ccfd614467cfb50b791278992e177 |
| cve_search |  | https://git.kernel.org/stable/c/f4f7e696db0274ff560482cc52eddbf0551d4b7a |
| cve_search |  | https://git.kernel.org/stable/c/a1eebe76e187dbe11ca299f8dbb6e45d5b1889e7 |
| cve_search |  | https://git.kernel.org/stable/c/bf4aeff7da85c3becd39fb73bac94122331c30fb |
| cve_search |  | https://git.kernel.org/stable/c/2b44760609e9eaafc9d234a6883d042fc21132a7 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26645 | https://ubuntu.com/security/CVE-2024-26645 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/2b44760609e9eaafc9d234a6883d042fc21132a7 | https://git.kernel.org/linus/c193707dde77ace92a649cd59a17e105e2fbeaef | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:tracing: Ensure visibility when inserting an element into tracing_mapRunning the following two commands in parallel on a multi-processorAArch64 machine can sporadically produce an unexpected warning aboutduplicate histogram entries: $ while true; do     echo hist:key=id.syscall:val=hitcount >         /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist     sleep 0.001   done $ stress-ng --sysbadaddr $(nproc)The warning looks as follows:[ 2911.172474] ------------[ cut here ]------------[ 2911.173111] Duplicates detected: 1[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408[ 2911.185310] sp : ffff8000a1513900[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480[ 2911.194259] Call trace:[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408[ 2911.195220]  hist_show+0x124/0x800[ 2911.195692]  seq_read_iter+0x1d4/0x4e8[ 2911.196193]  seq_read+0xe8/0x138[ 2911.196638]  vfs_read+0xc8/0x300[ 2911.197078]  ksys_read+0x70/0x108[ 2911.197534]  __arm64_sys_read+0x24/0x38[ 2911.198046]  invoke_syscall+0x78/0x108[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8[ 2911.199157]  do_el0_svc+0x28/0x40[ 2911.199613]  el0_svc+0x40/0x178[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0[ 2911.201115] ---[ end trace 0000000000000000 ]---The problem appears to be caused by CPU reordering of writes issued from__tracing_map_insert().The check for the presence of an element with a given key in thisfunction is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ...The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt;The  memcpy(elt->key, key, map->key_size);  and  entry->val = elt; stores may become visible in the reversed order on another CPU. Thissecond CPU might then incorrectly determine that a new key doesn t matchan already present val->key and subse---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS(5.10.0):受影响
4.openEuler-22.03-LTS-SP1(5.10.0):受影响
5.openEuler-22.03-LTS-SP2(5.10.0):受影响
6.openEuler-22.03-LTS-SP3(5.10.0):受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (23)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26645

Comments (23)

Search

src-openEuler/kernel
Closed