CVE-2024-26984

一、漏洞信息
 漏洞编号：[CVE-2024-26984](https://nvd.nist.gov/vuln/detail/CVE-2024-26984)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:nouveau: fix instmem race condition around ptr storesRunning a lot of VK CTS in parallel against nouveau, once everyfew hours you might see something like this crash.BUG: kernel NULL pointer dereference, address: 0000000000000008PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0Oops: 0000 [#1] PREEMPT SMP PTICPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1RSP: 0000:ffffac20c5857838 EFLAGS: 00010202RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001cR13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001cFS:  00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]Adding any sort of useful debug usually makes it go away, so I handwrote the function in a line, and debugged the asm.Every so often pt->memory->ptrs is NULL. This ptrs ptr is set inthe nv50_instobj_acquire called from nvkm_kmap.If Thread A and Thread B both get to nv50_instobj_acquire aroundthe same time, and Thread A hits the refcount_set line, and inlockstep thread B succeeds at refcount_inc_not_zero, there is achance the ptrs value won t have been stored since refcount_setis unordered. Force a memory barrier here, I picked smp_mb, sincewe want it on all CPUs and it s write followed by a read.v2: use paired smp_rmb/smp_wmb.
 漏洞公开时间：2024-05-01 14:15:15
 漏洞创建时间：2024-05-04 00:00:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-26984
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/13d76b2f443dc371842916dd8768009ff1594716 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26984 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26984.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-26984 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278333 | https://bugzilla.suse.com/show_bug.cgi?id=1223633 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-26984 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/linus/fff1386cc889d8fb4089d285f883f8cba62d82ce (6.9-rc5) | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-26984 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-26984 | https://ubuntu.com/security/CVE-2024-26984 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-26984 | https://ubuntu.com/security/CVE-2024-26984 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-26984 |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/fff1386cc889d8fb4089d285f883f8cba62d82ce | https://git.kernel.org/linus/be55287aa5ba6895e9d4d3ed2f08a1be7a065957 | ubuntu |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                       
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

修复是否涉及abi变化(是/否)：
  1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2024-26984	None	None	https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 https://git.kernel.org/stable/c/bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9 https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 https://git.kernel.org/stable/c/1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7 https://git.kernel.org/stable/c/13d76b2f443dc371842916dd8768009ff1594716 https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce
https://ubuntu.com/security/CVE-2024-26984	None	None	https://discourse.ubuntu.com/c/ubuntu-pro https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 https://git.kernel.org/linus/fff1386cc889d8fb4089d285f883f8cba62d82ce https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 https://git.kernel.org/linus/be55287aa5ba6895e9d4d3ed2f08a1be7a065957 https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce
https://www.opencve.io/cve/CVE-2024-26984	None	None	https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572 https://git.kernel.org/stable/c/bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9 https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52 https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525 https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039 https://git.kernel.org/stable/c/1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7 https://git.kernel.org/stable/c/13d76b2f443dc371842916dd8768009ff1594716 https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-26984
https://security-tracker.debian.org/tracker/CVE-2024-26984	None	None	https://git.kernel.org/linus/fff1386cc889d8fb4089d285f883f8cba62d82ce

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

src-openEuler/kernel

内容风险标识

评论 (3)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-26984

评论 (3)

搜索帮助

src-openEuler/kernel