CVE-2024-26991

一、漏洞信息
 漏洞编号：[CVE-2024-26991](https://nvd.nist.gov/vuln/detail/CVE-2024-26991)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:KVM: x86/mmu: x86: Don t overflow lpage_info when checking attributesFix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and triggerKASAN splat, as seen in the private_mem_conversions_test selftest.When memory attributes are set on a GFN range, that range will havespecific properties applied to the TDP. A huge page cannot be used whenthe attributes are inconsistent, so they are disabled for those thespecific huge pages. For internal KVM reasons, huge pages are also notallowed to span adjacent memslots regardless of whether the backing memorycould be mapped as huge.What GFNs support which huge page sizes is tracked by an array of arrays lpage_info  on the memslot, of ‘kvm_lpage_info’ structs. Each index oflpage_info contains a vmalloc allocated array of these for a specificsupported page size. The kvm_lpage_info denotes whether a specific hugepage (GFN and page size) on the memslot is supported. These arrays includeindices for unaligned head and tail huge pages.Preventing huge pages from spanning adjacent memslot is covered byincrementing the count in head and tail kvm_lpage_info when the memslot isallocated, but disallowing huge pages for memory that has mixed attributeshas to be done in a more complicated way. During theKVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot inthe range that has mismatched attributes. KVM does this a memslot at atime, and marks a special bit, KVM_LPAGE_MIXED_FLAG, in the kvm_lpage_infofor any huge page. This bit is essentially a permanently elevated count.So huge pages will not be mapped for the GFN at that page size if thecount is elevated in either case: a huge head or tail page unaligned tothe memslot or if KVM_LPAGE_MIXED_FLAG is set because it has mixedattributes.To determine whether a huge page has consistent attributes, theKVM_SET_MEMORY_ATTRIBUTES operation checks an xarray to make sure itconsistently has the incoming attribute. Since level - 1 huge pages arealigned to level huge pages, it employs an optimization. As long as thelevel - 1 huge pages are checked first, it can just check these and assumethat if each level - 1 huge page contained within the level sized hugepage is not mixed, then the level size huge page is not mixed. Thisoptimization happens in the helper hugepage_has_attrs().Unfortunately, although the kvm_lpage_info array representing page size level  will contain an entry for an unaligned tail page of size level,the array for level - 1  will not contain an entry for each GFN at pagesize level. The level - 1 array will only contain an index for anyunaligned region covered by level - 1 huge page size, which can be asmaller region. So this causes the optimization to overflow the level - 1kvm_lpage_info and perform a vmalloc out of bounds read.In some cases of head and tail pages where an overflow could happen,callers skip the operation completely as KVM_LPAGE_MIXED_FLAG is notrequired to prevent huge pages as discussed earlier. But for memslots thatare smaller than the 1GB page size, it does call hugepage_has_attrs(). Inthis case the huge page is both the head and tail page. The issue can beobserved simply by compiling the kernel with CONFIG_KASAN_VMALLOC andrunning the selftest “private_mem_conversions_test”, which produces theoutput like the following:BUG: KASAN: vmalloc-out-of-bounds in hugepage_has_attrs+0x7e/0x110Read of size 4 at addr ffffc900000a3008 by task private_mem_con/169Call Trace:  dump_stack_lvl  print_report  ? __virt_addr_valid  ? hugepage_has_attrs  ? hugepage_has_attrs  kasan_report  ? hugepage_has_attrs  hugepage_has_attrs  kvm_arch_post_set_memory_attributes  kvm_vm_ioctlIt is a little ambiguous whether the unaligned head page (in the bug casealso the tail page) should be expected to have KVM_LPAGE_MIXED_FLAG set.It is not functionally required, as the unal---truncated---
 漏洞公开时间：2024-05-01 14:15:16
 漏洞创建时间：2024-05-01 15:46:28
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26991
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26991 | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26991 | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| suse_bugzilla | https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| suse_bugzilla | https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4 | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26991.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278318 | https://bugzilla.suse.com/show_bug.cgi?id=1223695 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050144-CVE-2024-26991-f6d3@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278318 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26991 | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://git.kernel.org/linus/992b54bd083c5bee24ff7cc35991388ab08598c4 (6.9-rc5) | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4 | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26991 | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26991 | https://ubuntu.com/security/CVE-2024-26991 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26991 | https://ubuntu.com/security/CVE-2024-26991 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26991 |
| cve_search |  | https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c |
| cve_search |  | https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4 |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/992b54bd083c5bee24ff7cc35991388ab08598c4 | https://git.kernel.org/linus/90b4fe17981e155432c4dbc490606d0c2e9c2199 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  4.0
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS(5.10.0):不受影响
4.openEuler-22.03-LTS-SP1(5.10.0):不受影响
5.openEuler-22.03-LTS-SP2(5.10.0):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26991

Comments (5)

Search

src-openEuler/kernel
Closed