CVE-2024-27414

一、漏洞信息
 漏洞编号：[CVE-2024-27414](https://nvd.nist.gov/vuln/detail/CVE-2024-27414)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：5.5 Medium
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing backIn the commit d73ef2d69c0d ( rtnetlink: let rtnl_bridge_setlink checksIFLA_BRIDGE_MODE length ), an adjustment was made to the old loop logicin the function `rtnl_bridge_setlink` to enable the loop to also checkthe length of the IFLA_BRIDGE_MODE attribute. However, this adjustmentremoved the `break` statement and led to an error logic of the flagswriting back at the end of this function.if (have_flags)    memcpy(nla_data(attr), &flags, sizeof(flags));    // attr should point to IFLA_BRIDGE_FLAGS NLA !!!Before the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS.However, this is not necessarily true fow now as the updated loop will letthe attr point to the last NLA, even an invalid NLA which could causeoverflow writes.This patch introduces a new variable `br_flag` to save the NLA pointerthat points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentionederror logic.
 漏洞公开时间：2024-05-17 20:15:12
 漏洞创建时间：2024-05-17 12:30:14
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-27414
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27414 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-27414.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-27414 | https://bugzilla.suse.com/show_bug.cgi?id=1224439 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024051702-CVE-2024-27414-5c5d@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281103 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-27414 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-27414 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                                                                                  
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):
12.openEuler-24.03-LTS-SP2(6.6.0):

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):
12.openEuler-24.03-LTS-SP2(6.6.0):

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):
9.openEuler-24.03-LTS-SP3(6.6.0):

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-27414

Comments (7)

Search

src-openEuler/kernel
Closed