CVE-2024-26782

一、漏洞信息
 漏洞编号：[CVE-2024-26782](https://nvd.nist.gov/vuln/detail/CVE-2024-26782)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mptcp: fix double-free on socket dismantlewhen MPTCP server accepts an incoming connection, it clones its listenersocket. However, the pointer to  inet_opt  for the new socket has the samevalue as the original one: as a consequence, on program exit it s possibleto observe the following splat:  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0  Free of addr ffff888485950880 by task swapper/25/0  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013  Call Trace:   <IRQ>   dump_stack_lvl+0x32/0x50   print_report+0xca/0x620   kasan_report_invalid_free+0x64/0x90   __kasan_slab_free+0x1aa/0x1f0   kfree+0xed/0x2e0   inet_sock_destruct+0x54f/0x8b0   __sk_destruct+0x48/0x5b0   rcu_do_batch+0x34e/0xd90   rcu_core+0x559/0xac0   __do_softirq+0x183/0x5a4   irq_exit_rcu+0x12d/0x170   sysvec_apic_timer_interrupt+0x6b/0x80   </IRQ>   <TASK>   asm_sysvec_apic_timer_interrupt+0x16/0x20  RIP: 0010:cpuidle_enter_state+0x175/0x300  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80   cpuidle_enter+0x4a/0xa0   do_idle+0x310/0x410   cpu_startup_entry+0x51/0x60   start_secondary+0x211/0x270   secondary_startup_64_no_verify+0x184/0x18b   </TASK>  Allocated by task 6853:   kasan_save_stack+0x1c/0x40   kasan_save_track+0x10/0x30   __kasan_kmalloc+0xa6/0xb0   __kmalloc+0x1eb/0x450   cipso_v4_sock_setattr+0x96/0x360   netlbl_sock_setattr+0x132/0x1f0   selinux_netlbl_socket_post_create+0x6c/0x110   selinux_socket_post_create+0x37b/0x7f0   security_socket_post_create+0x63/0xb0   __sock_create+0x305/0x450   __sys_socket_create.part.23+0xbd/0x130   __sys_socket+0x37/0xb0   __x64_sys_socket+0x6f/0xb0   do_syscall_64+0x83/0x160   entry_SYSCALL_64_after_hwframe+0x6e/0x76  Freed by task 6858:   kasan_save_stack+0x1c/0x40   kasan_save_track+0x10/0x30   kasan_save_free_info+0x3b/0x60   __kasan_slab_free+0x12c/0x1f0   kfree+0xed/0x2e0   inet_sock_destruct+0x54f/0x8b0   __sk_destruct+0x48/0x5b0   subflow_ulp_release+0x1f0/0x250   tcp_cleanup_ulp+0x6e/0x110   tcp_v4_destroy_sock+0x5a/0x3a0   inet_csk_destroy_sock+0x135/0x390   tcp_fin+0x416/0x5c0   tcp_data_queue+0x1bc8/0x4310   tcp_rcv_state_process+0x15a3/0x47b0   tcp_v4_do_rcv+0x2c1/0x990   tcp_v4_rcv+0x41fb/0x5ed0   ip_protocol_deliver_rcu+0x6d/0x9f0   ip_local_deliver_finish+0x278/0x360   ip_local_deliver+0x182/0x2c0   ip_rcv+0xb5/0x1c0   __netif_receive_skb_one_core+0x16e/0x1b0   process_backlog+0x1e3/0x650   __napi_poll+0xa6/0x500   net_rx_action+0x740/0xbb0   __do_softirq+0x183/0x5a4  The buggy address belongs to the object at ffff888485950880   which belongs to the cache kmalloc-64 of size 64  The buggy address is located 0 bytes inside of   64-byte region [ffff888485950880, ffff8884859508c0)  The buggy address belongs to the physical page:  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)  page_type: 0xffffffff()  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000  page dumped because: kasan: bad access detected  Memory state around the buggy address:   ffff888485950780: fa fb fb---truncated---
 漏洞公开时间：2024-04-04 17:15:08
 漏洞创建时间：2024-04-04 17:46:14
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26782
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26782 | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26782 | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582 | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85 | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2273468 | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26782.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1222590 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024040458-CVE-2024-26782-71ca@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2273468 |
| ubuntu | https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85 | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582 | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26782 | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26782 | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26782 | https://ubuntu.com/security/CVE-2024-26782 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26782 | https://ubuntu.com/security/CVE-2024-26782 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26782 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26782 | https://ubuntu.com/security/CVE-2024-26782 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/10048689def7e40a4405acda16fdc6477d4ecc5c | https://git.kernel.org/linus/cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:mptcp: fix double-free on socket dismantlewhen MPTCP server accepts an incoming connection, it clones its listenersocket. However, the pointer to  inet_opt  for the new socket has the samevalue as the original one: as a consequence, on program exit it s possibleto observe the following splat:  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0  Free of addr ffff888485950880 by task swapper/25/0  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013  Call Trace:   <IRQ>   dump_stack_lvl+0x32/0x50   print_report+0xca/0x620   kasan_report_invalid_free+0x64/0x90   __kasan_slab_free+0x1aa/0x1f0   kfree+0xed/0x2e0   inet_sock_destruct+0x54f/0x8b0   __sk_destruct+0x48/0x5b0   rcu_do_batch+0x34e/0xd90   rcu_core+0x559/0xac0   __do_softirq+0x183/0x5a4   irq_exit_rcu+0x12d/0x170   sysvec_apic_timer_interrupt+0x6b/0x80   </IRQ>   <TASK>   asm_sysvec_apic_timer_interrupt+0x16/0x20  RIP: 0010:cpuidle_enter_state+0x175/0x300  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80   cpuidle_enter+0x4a/0xa0   do_idle+0x310/0x410   cpu_startup_entry+0x51/0x60   start_secondary+0x211/0x270   secondary_startup_64_no_verify+0x184/0x18b   </TASK>  Allocated by task 6853:   kasan_save_stack+0x1c/0x40   kasan_save_track+0x10/0x30   __kasan_kmalloc+0xa6/0xb0   __kmalloc+0x1eb/0x450   cipso_v4_sock_setattr+0x96/0x360   netlbl_sock_setattr+0x132/0x1f0   selinux_netlbl_socket_post_create+0x6c/0x110   selinux_socket_post_create+0x37b/0x7f0   security_socket_post_create+0x63/0xb0   __sock_create+0x305/0x450   __sys_socket_create.part.23+0xbd/0x130   __sys_socket+0x37/0xb0   __x64_sys_socket+0x6f/0xb0   do_syscall_64+0x83/0x160   entry_SYSCALL_64_after_hwframe+0x6e/0x76  Freed by task 6858:   kasan_save_stack+0x1c/0x40   kasan_save_track+0x10/0x30   kasan_save_free_info+0x3b/0x60   __kasan_slab_free+0x12c/0x1f0   kfree+0xed/0x2e0   inet_sock_destruct+0x54f/0x8b0   __sk_destruct+0x48/0x5b0   subflow_ulp_release+0x1f0/0x250   tcp_cleanup_ulp+0x6e/0x110   tcp_v4_destroy_sock+0x5a/0x3a0   inet_csk_destroy_sock+0x135/0x390   tcp_fin+0x416/0x5c0   tcp_data_queue+0x1bc8/0x4310   tcp_rcv_state_process+0x15a3/0x47b0   tcp_v4_do_rcv+0x2c1/0x990   tcp_v4_rcv+0x41fb/0x5ed0   ip_protocol_deliver_rcu+0x6d/0x9f0   ip_local_deliver_finish+0x278/0x360   ip_local_deliver+0x182/0x2c0   ip_rcv+0xb5/0x1c0   __netif_receive_skb_one_core+0x16e/0x1b0   process_backlog+0x1e3/0x650   __napi_poll+0xa6/0x500   net_rx_action+0x740/0xbb0   __do_softirq+0x183/0x5a4  The buggy address belongs to the object at ffff888485950880   which belongs to the cache kmalloc-64 of size 64  The buggy address is located 0 bytes inside of   64-byte region [ffff888485950880, ffff8884859508c0)  The buggy address belongs to the physical page:  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)  page_type: 0xffffffff()  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000  page dumped because: kasan: bad access detected  Memory state around the buggy address:   ffff888485950780: fa fb fb---truncated---  
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS(5.10.0):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP2(5.10.0):受影响
4.openEuler-22.03-LTS-SP3(5.10.0):受影响
5.openEuler-20.03-LTS-SP1(4.19.90):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.openEuler-22.03-LTS-SP4:不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS:不受影响
11.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否
11.openEuler-22.03-LTS-SP4:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1649

src-openEuler/kernel

Content Risk Flag

Comments (12)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26782

Comments (12)

Search

src-openEuler/kernel