CVE-2024-35853

一、漏洞信息
 漏洞编号：[CVE-2024-35853](https://nvd.nist.gov/vuln/detail/CVE-2024-35853)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_tcam: Fix memory leak during rehashThe rehash delayed work migrates filters from one region to another.This is done by iterating over all chunks (all the filters with the samepriority) in the region and in each chunk iterating over all thefilters.If the migration fails, the code tries to migrate the filters back tothe old region. However, the rollback itself can also fail in which caseanother migration will be erroneously performed. Besides the fact thatthis ping pong is not a very good idea, it also creates a problem.Each virtual chunk references two chunks: The currently used one( vchunk->chunk ) and a backup ( vchunk->chunk2 ). During migration thefirst holds the chunk we want to migrate filters to and the second holdsthe chunk we are migrating filters from.The code currently assumes - but does not verify - that the backup chunkdoes not exist (NULL) if the currently used chunk does not reference thetarget region. This assumption breaks when we are trying to rollback arollback, resulting in the backup chunk being overwritten and leaked[1].Fix by not rolling back a failed rollback and add a warning to avoidfuture cases.[1]WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20Modules linked in:CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workRIP: 0010:parman_destroy+0x17/0x20[...]Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
 漏洞公开时间：2024-05-17 23:15:22
 漏洞创建时间：2024-05-17 15:42:19
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35853
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35853 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35853.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35853 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2281255 | https://bugzilla.suse.com/show_bug.cgi?id=1224604 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35853-869a@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281255 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4211 | https://bugzilla.redhat.com/show_bug.cgi?id=2281255 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4352 | https://bugzilla.redhat.com/show_bug.cgi?id=2281255 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35853 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-35853 |
| cve_search |  | https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76 |
| cve_search |  | https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1 |
| cve_search |  | https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e |
| cve_search |  | https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76 |
| cve_search |  | https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf |
| cve_search |  | https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d |
| cve_search |  | https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0263.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_tcam: Fix memory leak during rehashThe rehash delayed work migrates filters from one region to another.This is done by iterating over all chunks (all the filters with the samepriority) in the region and in each chunk iterating over all thefilters.If the migration fails, the code tries to migrate the filters back tothe old region. However, the rollback itself can also fail in which caseanother migration will be erroneously performed. Besides the fact thatthis ping pong is not a very good idea, it also creates a problem.Each virtual chunk references two chunks: The currently used one( vchunk->chunk ) and a backup ( vchunk->chunk2 ). During migration thefirst holds the chunk we want to migrate filters to and the second holdsthe chunk we are migrating filters from.The code currently assumes - but does not verify - that the backup chunkdoes not exist (NULL) if the currently used chunk does not reference thetarget region. This assumption breaks when we are trying to rollback arollback, resulting in the backup chunk being overwritten and leaked[1].Fix by not rolling back a failed rollback and add a warning to avoidfuture cases.[1]WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20Modules linked in:CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workRIP: 0010:parman_destroy+0x17/0x20[...]Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
 openEuler评分：
  6.4
 Vector：CVSS：3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (34)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-35853

Comments (34)

Search

src-openEuler / kernel
Closed