CVE-2024-35854

一、漏洞信息
 漏洞编号：[CVE-2024-35854](https://nvd.nist.gov/vuln/detail/CVE-2024-35854)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehashThe rehash delayed work migrates filters from one region to anotheraccording to the number of available credits.The migrated from region is destroyed at the end of the work if thenumber of credits is non-negative as the assumption is that this isindicative of migration being complete. This assumption is incorrect asa non-negative number of credits can also be the result of a failedmigration.The destruction of a region that still has filters referencing it canresult in a use-after-free [1].Fix by not destroying the region if migration failed.[1]BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workCall Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
 漏洞公开时间：2024-05-17 23:15:22
 漏洞创建时间：2024-05-17 15:52:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35854
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35854 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35854.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35854 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2281253 | https://bugzilla.suse.com/show_bug.cgi?id=1224636 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35854-d17b@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281253 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4211 | https://bugzilla.redhat.com/show_bug.cgi?id=2281253 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4352 | https://bugzilla.redhat.com/show_bug.cgi?id=2281253 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35854 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/linus/54225988889931467a9b55fdbef534079b665519 (6.9-rc6) | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://ubuntu.com/security/notices/USN-6896-1 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35854 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35854 | https://ubuntu.com/security/CVE-2024-35854 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35854 | https://ubuntu.com/security/CVE-2024-35854 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35854 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-35854 |
| cve_search |  | https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388 |
| cve_search |  | https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1 |
| cve_search |  | https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121 |
| cve_search |  | https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887 |
| cve_search |  | https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049 |
| cve_search |  | https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 |
| cve_search |  | https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519 |
| cve_search |  | https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0263.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/54225988889931467a9b55fdbef534079b665519 | https://git.kernel.org/linus/c9c9af91f1d9a636aecc55302c792538e549a430 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehashThe rehash delayed work migrates filters from one region to anotheraccording to the number of available credits.The migrated from region is destroyed at the end of the work if thenumber of credits is non-negative as the assumption is that this isindicative of migration being complete. This assumption is incorrect asa non-negative number of credits can also be the result of a failedmigration.The destruction of a region that still has filters referencing it canresult in a use-after-free [1].Fix by not destroying the region if migration failed.[1]BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_workCall Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK>Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
 openEuler评分：
  8.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

内容风险标识

评论 (27)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-35854

评论 (27)

搜索帮助

src-openEuler/kernel