CVE-2024-26953

一、漏洞信息
 漏洞编号：[CVE-2024-26953](https://nvd.nist.gov/vuln/detail/CVE-2024-26953)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net: esp: fix bad handling of pages from page_poolWhen the skb is reorganized during esp_output (!esp->inline), the pagescoming from the original skb fragments are supposed to be released backto the system through put_page. But if the skb fragment pages areoriginating from a page_pool, calling put_page on them will trigger apage_pool leak which will eventually result in a crash.This leak can be easily observed when using CONFIG_DEBUG_VM and doingipsec + gre (non offloaded) forwarding:  BUG: Bad page state in process ksoftirqd/16  pfn:1451b6  page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6  flags: 0x200000000000000(node=0|zone=2)  page_type: 0xffffffff()  raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000  raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000  page dumped because: page_pool leak  Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]  CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014  Call Trace:   <TASK>   dump_stack_lvl+0x36/0x50   bad_page+0x70/0xf0   free_unref_page_prepare+0x27a/0x460   free_unref_page+0x38/0x120   esp_ssg_unref.isra.0+0x15f/0x200   esp_output_tail+0x66d/0x780   esp_xmit+0x2c5/0x360   validate_xmit_xfrm+0x313/0x370   ? validate_xmit_skb+0x1d/0x330   validate_xmit_skb_list+0x4c/0x70   sch_direct_xmit+0x23e/0x350   __dev_queue_xmit+0x337/0xba0   ? nf_hook_slow+0x3f/0xd0   ip_finish_output2+0x25e/0x580   iptunnel_xmit+0x19b/0x240   ip_tunnel_xmit+0x5fb/0xb60   ipgre_xmit+0x14d/0x280 [ip_gre]   dev_hard_start_xmit+0xc3/0x1c0   __dev_queue_xmit+0x208/0xba0   ? nf_hook_slow+0x3f/0xd0   ip_finish_output2+0x1ca/0x580   ip_sublist_rcv_finish+0x32/0x40   ip_sublist_rcv+0x1b2/0x1f0   ? ip_rcv_finish_core.constprop.0+0x460/0x460   ip_list_rcv+0x103/0x130   __netif_receive_skb_list_core+0x181/0x1e0   netif_receive_skb_list_internal+0x1b3/0x2c0   napi_gro_receive+0xc8/0x200   gro_cell_poll+0x52/0x90   __napi_poll+0x25/0x1a0   net_rx_action+0x28e/0x300   __do_softirq+0xc3/0x276   ? sort_range+0x20/0x20   run_ksoftirqd+0x1e/0x30   smpboot_thread_fn+0xa6/0x130   kthread+0xcd/0x100   ? kthread_complete_and_exit+0x20/0x20   ret_from_fork+0x31/0x50   ? kthread_complete_and_exit+0x20/0x20   ret_from_fork_asm+0x11/0x20   </TASK>The suggested fix is to introduce a new wrapper (skb_page_unref) thatcovers page refcounting for page_pool pages as well.
 漏洞公开时间：2024-05-01 14:15:11
 漏洞创建时间：2024-05-01 07:47:35
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26953
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26953 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26953 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26953.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278193 | https://bugzilla.suse.com/show_bug.cgi?id=1223656 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26953-8304@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278193 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26953 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-26953 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net: esp: fix bad handling of pages from page_poolWhen the skb is reorganized during esp_output (!esp->inline), the pagescoming from the original skb fragments are supposed to be released backto the system through put_page. But if the skb fragment pages areoriginating from a page_pool, calling put_page on them will trigger apage_pool leak which will eventually result in a crash.This leak can be easily observed when using CONFIG_DEBUG_VM and doingipsec + gre (non offloaded) forwarding:  BUG: Bad page state in process ksoftirqd/16  pfn:1451b6  page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6  flags: 0x200000000000000(node=0|zone=2)  page_type: 0xffffffff()  raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000  raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000  page dumped because: page_pool leak  Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]  CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014  Call Trace:   <TASK>   dump_stack_lvl+0x36/0x50   bad_page+0x70/0xf0   free_unref_page_prepare+0x27a/0x460   free_unref_page+0x38/0x120   esp_ssg_unref.isra.0+0x15f/0x200   esp_output_tail+0x66d/0x780   esp_xmit+0x2c5/0x360   validate_xmit_xfrm+0x313/0x370   ? validate_xmit_skb+0x1d/0x330   validate_xmit_skb_list+0x4c/0x70   sch_direct_xmit+0x23e/0x350   __dev_queue_xmit+0x337/0xba0   ? nf_hook_slow+0x3f/0xd0   ip_finish_output2+0x25e/0x580   iptunnel_xmit+0x19b/0x240   ip_tunnel_xmit+0x5fb/0xb60   ipgre_xmit+0x14d/0x280 [ip_gre]   dev_hard_start_xmit+0xc3/0x1c0   __dev_queue_xmit+0x208/0xba0   ? nf_hook_slow+0x3f/0xd0   ip_finish_output2+0x1ca/0x580   ip_sublist_rcv_finish+0x32/0x40   ip_sublist_rcv+0x1b2/0x1f0   ? ip_rcv_finish_core.constprop.0+0x460/0x460   ip_list_rcv+0x103/0x130   __netif_receive_skb_list_core+0x181/0x1e0   netif_receive_skb_list_internal+0x1b3/0x2c0   napi_gro_receive+0xc8/0x200   gro_cell_poll+0x52/0x90   __napi_poll+0x25/0x1a0   net_rx_action+0x28e/0x300   __do_softirq+0xc3/0x276   ? sort_range+0x20/0x20   run_ksoftirqd+0x1e/0x30   smpboot_thread_fn+0xa6/0x130   kthread+0xcd/0x100   ? kthread_complete_and_exit+0x20/0x20   ret_from_fork+0x31/0x50   ? kthread_complete_and_exit+0x20/0x20   ret_from_fork_asm+0x11/0x20   </TASK>The suggested fix is to introduce a new wrapper (skb_page_unref) thatcovers page refcounting for page_pool pages as well.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.master:不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master:否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
2.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
3.master:不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

Content Risk Flag

Comments (30)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-26953

Comments (30)

Search

src-openEuler/kernel