CVE-2024-27018

一、漏洞信息
 漏洞编号：[CVE-2024-27018](https://nvd.nist.gov/vuln/detail/CVE-2024-27018)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:netfilter: br_netfilter: skip conntrack input hook for promisc packetsFor historical reasons, when bridge device is in promisc mode, packetsthat are directed to the taps follow bridge input hook path. This patchadds a workaround to reset conntrack for these packets.Jianbo Liu reports warning splats in their test infrastructure wherecloned packets reach the br_netfilter input hook to confirm theconntrack object.Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet hasreached the input hook because it is passed up to the bridge device toreach the taps.[   57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter][   57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core[   57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19[   57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014[   57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter][   57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1[   57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202[   57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000[   57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000[   57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003[   57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000[   57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800[   57.582313] FS:  0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000[   57.583040] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[   57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0[   57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[   57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[   57.585440] Call Trace:[   57.585721]  <IRQ>[   57.585976]  ? __warn+0x7d/0x130[   57.586323]  ? br_nf_local_in+0x157/0x180 [br_netfilter][   57.586811]  ? report_bug+0xf1/0x1c0[   57.587177]  ? handle_bug+0x3f/0x70[   57.587539]  ? exc_invalid_op+0x13/0x60[   57.587929]  ? asm_exc_invalid_op+0x16/0x20[   57.588336]  ? br_nf_local_in+0x157/0x180 [br_netfilter][   57.588825]  nf_hook_slow+0x3d/0xd0[   57.589188]  ? br_handle_vlan+0x4b/0x110[   57.589579]  br_pass_frame_up+0xfc/0x150[   57.589970]  ? br_port_flags_change+0x40/0x40[   57.590396]  br_handle_frame_finish+0x346/0x5e0[   57.590837]  ? ipt_do_table+0x32e/0x430[   57.591221]  ? br_handle_local_finish+0x20/0x20[   57.591656]  br_nf_hook_thresh+0x4b/0xf0 [br_netfilter][   57.592286]  ? br_handle_local_finish+0x20/0x20[   57.592802]  br_nf_pre_routing_finish+0x178/0x480 [br_netfilter][   57.593348]  ? br_handle_local_finish+0x20/0x20[   57.593782]  ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat][   57.594279]  br_nf_pre_routing+0x24c/0x550 [br_netfilter][   57.594780]  ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter][   57.595280]  br_handle_frame+0x1f3/0x3d0[   57.595676]  ? br_handle_local_finish+0x20/0x20[   57.596118]  ? br_handle_frame_finish+0x5e0/0x5e0[   57.596566]  __netif_receive_skb_core+0x25b/0xfc0[   57.597017]  ? __napi_build_skb+0x37/0x40[   57.597418]  __netif_receive_skb_list_core+0xfb/0x220
 漏洞公开时间：2024-05-01 14:15:20
 漏洞创建时间：2024-05-08 06:21:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-27018
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27018 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-27018 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-27018.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278260 | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| suse_bugzilla | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ | https://bugzilla.suse.com/show_bug.cgi?id=1223809 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050150-CVE-2024-27018-d8a7@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278260 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-27018 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-27018 |
| cve_search |  | https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4 |
| cve_search |  | https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6 |
| cve_search |  | https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d |
| cve_search |  | https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615 |
| cve_search |  | https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0263.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d |  | nvd |
|  |  | https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615 |  | nvd |
|  |  | https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178 |  | nvd |
|  |  | https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                              In the Linux kernel, the following vulnerability has been resolved:netfilter: br_netfilter: skip conntrack input hook for promisc packetsFor historical reasons, when bridge device is in promisc mode, packetsthat are directed to the taps follow bridge input hook path. This patchadds a workaround to reset conntrack for these packets.Jianbo Liu reports warning splats in their test infrastructure wherecloned packets reach the br_netfilter input hook to confirm theconntrack object.Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet hasreached the input hook because it is passed up to the bridge device toreach the taps.[   57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter][   57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core[   57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19[   57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014[   57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter][   57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1[   57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202[   57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000[   57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000[   57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003[   57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000[   57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800[   57.582313] FS:  0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000[   57.583040] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[   57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0[   57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[   57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[   57.585440] Call Trace:[   57.585721]  <IRQ>[   57.585976]  ? __warn+0x7d/0x130[   57.586323]  ? br_nf_local_in+0x157/0x180 [br_netfilter][   57.586811]  ? report_bug+0xf1/0x1c0[   57.587177]  ? handle_bug+0x3f/0x70[   57.587539]  ? exc_invalid_op+0x13/0x60[   57.587929]  ? asm_exc_invalid_op+0x16/0x20[   57.588336]  ? br_nf_local_in+0x157/0x180 [br_netfilter][   57.588825]  nf_hook_slow+0x3d/0xd0[   57.589188]  ? br_handle_vlan+0x4b/0x110[   57.589579]  br_pass_frame_up+0xfc/0x150[   57.589970]  ? br_port_flags_change+0x40/0x40[   57.590396]  br_handle_frame_finish+0x346/0x5e0[   57.590837]  ? ipt_do_table+0x32e/0x430[   57.591221]  ? br_handle_local_finish+0x20/0x20[   57.591656]  br_nf_hook_thresh+0x4b/0xf0 [br_netfilter][   57.592286]  ? br_handle_local_finish+0x20/0x20[   57.592802]  br_nf_pre_routing_finish+0x178/0x480 [br_netfilter][   57.593348]  ? br_handle_local_finish+0x20/0x20[   57.593782]  ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat][   57.594279]  br_nf_pre_routing+0x24c/0x550 [br_netfilter][   57.594780]  ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter][   57.595280]  br_handle_frame+0x1f3/0x3d0[   57.595676]  ? br_handle_local_finish+0x20/0x20[   57.596118]  ? br_handle_frame_finish+0x5e0/0x5e0[   57.596566]  __netif_receive_skb_core+0x25b/0xfc0[   57.597017]  ? __napi_build_skb+0x37/0x40[   57.597418]  __netif_receive_skb_list_core+0xfb/0x220              
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.12.33):不受影响
6.openEuler-22.03-LTS-Next(5.10.0):不受影响
7.openEuler-24.03-LTS:不受影响
8.openEuler-24.03-LTS-Next:不受影响
9.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.12.33):否
5.openEuler-22.03-LTS-Next(5.10.0):否
6.openEuler-24.03-LTS:否
7.openEuler-24.03-LTS-Next:否
8.openEuler-22.03-LTS-SP4(5.10.0):否
9.openEuler-24.03-LTS-SP2:
10.master(6.12.33):
11.openEuler-20.03-LTS-SP4(4.19.90):
12.openEuler-22.03-LTS-SP3(5.10.0):
13.openEuler-22.03-LTS-SP4(5.10.0):
14.openEuler-24.03-LTS:
15.openEuler-24.03-LTS-Next:
16.openEuler-24.03-LTS-SP1:
17.openEuler-24.03-LTS-SP2:
18.master(6.12.33):
19.openEuler-20.03-LTS-SP4(4.19.90):
20.openEuler-22.03-LTS-SP3(5.10.0):
21.openEuler-22.03-LTS-SP4(5.10.0):
22.openEuler-24.03-LTS:
23.openEuler-24.03-LTS-Next:
24.openEuler-24.03-LTS-SP1:
25.openEuler-24.03-LTS-SP2:
26.master(6.12.33):
27.openEuler-20.03-LTS-SP4(4.19.90):
28.openEuler-22.03-LTS-SP3(5.10.0):
29.openEuler-22.03-LTS-SP4(5.10.0):
30.openEuler-24.03-LTS:
31.openEuler-24.03-LTS-Next:
32.openEuler-24.03-LTS-SP1:
33.openEuler-24.03-LTS-SP2:
34.master(6.12.33):
35.openEuler-20.03-LTS-SP4(4.19.90):
36.openEuler-22.03-LTS-SP3(5.10.0):
37.openEuler-22.03-LTS-SP4(5.10.0):
38.openEuler-24.03-LTS:
39.openEuler-24.03-LTS-Next:
40.openEuler-24.03-LTS-SP1:
41.openEuler-24.03-LTS-SP2:
42.master(6.12.33):
43.openEuler-20.03-LTS-SP4(4.19.90):
44.openEuler-22.03-LTS-SP3(5.10.0):
45.openEuler-22.03-LTS-SP4(5.10.0):
46.openEuler-24.03-LTS:
47.openEuler-24.03-LTS-Next:
48.openEuler-24.03-LTS-SP1:
49.openEuler-24.03-LTS-SP2:
50.master(6.12.33):
51.openEuler-20.03-LTS-SP4(4.19.90):
52.openEuler-22.03-LTS-SP3(5.10.0):
53.openEuler-22.03-LTS-SP4(5.10.0):
54.openEuler-24.03-LTS:
55.openEuler-24.03-LTS-Next:
56.openEuler-24.03-LTS-SP1:
57.openEuler-24.03-LTS-SP2:
58.master(6.12.33):
59.openEuler-20.03-LTS-SP4(4.19.90):
60.openEuler-22.03-LTS-SP3(5.10.0):
61.openEuler-22.03-LTS-SP4(5.10.0):
62.openEuler-24.03-LTS:
63.openEuler-24.03-LTS-Next:
64.openEuler-24.03-LTS-SP1:
65.openEuler-24.03-LTS-SP2:
66.master(6.12.33):
67.openEuler-20.03-LTS-SP4(4.19.90):
68.openEuler-22.03-LTS-SP3(5.10.0):
69.openEuler-22.03-LTS-SP4(5.10.0):
70.openEuler-24.03-LTS:
71.openEuler-24.03-LTS-Next:
72.openEuler-24.03-LTS-SP1:
73.openEuler-24.03-LTS-SP2:
74.master(6.12.33):
75.openEuler-20.03-LTS-SP4(4.19.90):
76.openEuler-22.03-LTS-SP3(5.10.0):
77.openEuler-22.03-LTS-SP4(5.10.0):
78.openEuler-24.03-LTS:
79.openEuler-24.03-LTS-Next:
80.openEuler-24.03-LTS-SP1:
81.openEuler-24.03-LTS-SP2:
82.master(6.12.33):
83.openEuler-20.03-LTS-SP4(4.19.90):
84.openEuler-22.03-LTS-SP3(5.10.0):
85.openEuler-22.03-LTS-SP4(5.10.0):
86.openEuler-24.03-LTS:
87.openEuler-24.03-LTS-Next:
88.openEuler-24.03-LTS-SP1:
89.openEuler-24.03-LTS-SP2:
90.master(6.12.33):
91.openEuler-20.03-LTS-SP4(4.19.90):

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/kernel
关闭

内容风险标识

评论 (6)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-27018

评论 (6)

搜索帮助

src-openEuler/kernel
关闭